Getting Data In

How do I hide a value from field in Splunk from list of two values?

AbhinavRanjan
Loves-to-Learn Lots

I have two values in a field source, I need to hide one i.e., http:kafka

AbhinavRanjan_0-1663508581919.png

 

Labels (1)
0 Karma

AbhinavRanjan
Loves-to-Learn Lots

@gcusello  query I am using

|table _time,cluster_name,namespaceName,podName,policyName,message, severity,action,tags,resource,source,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AbhinavRanjan,

how dinamic data source fields are generated?

is it possible for you to use a different name?

if not you have to manipulate your multivalue to always take the first or the second, something like this:

...
| eval source=mvindex(source,0)
| table _time,cluster_name,namespaceName,podName,policyName,message, severity,action,tags,resource,source,

Ciao.

Giuseppe

0 Karma

AbhinavRanjan
Loves-to-Learn Lots

@gcusello 

I have two source fields, One from the Splunk configuration(static throughout) and another from the logs which I am forwarding(dynamic data) , both are getting merged into a single field.

I just want to hide the configuration data, i.e http:kafka here from the source

AbhinavRanjan_1-1663518377501.png

 

 

0 Karma

AbhinavRanjan
Loves-to-Learn Lots

I have two source fields, One from the Splunk configuration(static throughout) and another from the logs which I am forwarding(dynamic data) , both are getting merged into a single field.

I just want to hide the configuration data, i.e http:kafka here from the source

AbhinavRanjan_0-1663518315049.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AbhinavRanjan,

every event has one source value, so probably you're speaking of a search result aggregating more values from many events, probably in a stats command using the list option,

could you share your search?

Anyway, if you're speaking of a value from a stats command, use first or last or values instead of list option.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...