Splunk Search

Display only a particular key

Path Finder


Can someone help me with the splunk query where i need to display only eapply as the key

...|eval key=mvindex(split(nbamboo_buildkey,"="),1) | table key

it displays all the bamboo_buildkey along with eapply, repository number, etc 

Labels (5)
Tags (1)
0 Karma


Will this work?

...|eval key=mvindex(split(nbamboo_buildkey,"="),1) 
| where key="eapply"
| table key
0 Karma


Hi @Nith1,

Can you please give a sample event for nbamboo_buildkey for us to help?

If this reply helps you an upvote is appreciated.
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...