Splunk Search

Display only a particular key

Nith1
Path Finder

Hi

Can someone help me with the splunk query where i need to display only eapply as the key

...|eval key=mvindex(split(nbamboo_buildkey,"="),1) | table key

it displays all the bamboo_buildkey along with eapply, repository number, etc 


Labels (5)
Tags (1)
0 Karma

ITWhisperer
Ultra Champion

Will this work?

...|eval key=mvindex(split(nbamboo_buildkey,"="),1) 
| where key="eapply"
| table key
0 Karma

scelikok
Champion

Hi @Nith1,

Can you please give a sample event for nbamboo_buildkey for us to help?

If this reply helps you an upvote is appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!