Splunk Search

How do I refer to the first, nth or last value of a multivalue field?

cfrln
Explorer

I am using the transaction command to sessionize web access log events and therefore have made referer, uri etc. into multivalue fields. How do I report on the first value of referer? The second page visited? The exit page?

Tags (2)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the mvindex eval function that's described in: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

As an example: ... | eval second_uri = mvindex(uri, 1) | ...

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the mvindex eval function that's described in: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

As an example: ... | eval second_uri = mvindex(uri, 1) | ...

gkanapathy
Splunk Employee
Splunk Employee

hulahoop, the field value ordering is controlled by the "mvlist" parameter of the "transaction" command: http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

hulahoop
Splunk Employee
Splunk Employee

Very cool! Are mv fields sorted by time in a transaction?

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...