Display only specific values in a column field in Splunk

[sudeep5689]

Hi, I have a list of values getting displayed in one of the columns - Error Messages (for all languages) which i have collected in one row for each of the error code. So is there a way that i can show only the english messages in display with being able to count all the error messages for all languages.

Error Code Message Count
302 Eng, fra 2

200 spa,fra,italian, arabic, eng 5

So i want the o/p as

Error Code Message Count
302 Eng 2

200 eng 5

I tried to use mvindex but its failing since some of the error message come at top while some at last. Please note that i don't want the count to be changed

[martin_mueller]

Use mvfilter(lower(Message) = "eng"), or some other filter to detect English.

[martin_mueller]

Filter based on that then.

[martin_mueller]

I don't see language:eng in there.

[sudeep5689]

its not in this. its coming as one of the tags in the response

like language:eng LocalizedMessage:

[martin_mueller]

I can't tell you how to use your data if you don't post your data.

[sudeep5689]

this is the o/p of one of the field:

Angef
El estado del contrato solicitado no se recuper
Le statut de contrat demand
O status do contrato solicitado n
Requested status was not retrieved

Here i want to show just the last one

[martin_mueller]

Filter by language:eng then?

[sudeep5689]

Should i use mvfilter(language:eng)? but this will not work right? Can you pls help me with this and language:eng comes as a separate entity

[martin_mueller]

I don't think there is a language detection function in Splunk.
Do your original events have a language field?

[sudeep5689]

Hi, yes in response "language:eng" comes for english language. For spanish it would be "language"spa"

[martin_mueller]

You can use any boolean eval expression inside mvfilter(), including regex match().

[sudeep5689]

Hi Martin,

Thanks but it would be again a difficult taskk since other languages will contain letters as well.

One of the o/p is:
Angef
El estado del contrato solicitado no se recuper
Le statut de contrat demand
O status do contrato solicitado n
Requested status was not retrieved

From above o/p i want to extract the english one which is the last one

[sudeep5689]

Hi Thanks for your response. But eng is not a fixed word. The error messages are coming in diff languages and m clubing them together as per the error code. Now in the error messages column i dont want to show all the messages from each and every language but just show the english language message. In the response language:eng is coming for english.