Splunk Search
Highlighted

How do I refer to the first, nth or last value of a multivalue field?

Explorer

I am using the transaction command to sessionize web access log events and therefore have made referer, uri etc. into multivalue fields. How do I report on the first value of referer? The second page visited? The exit page?

Tags (2)
Highlighted

Re: How do I refer to the first, nth or last value of a multivalue field?

Motivator

You can use the mvindex eval function that's described in: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

As an example: ... | eval second_uri = mvindex(uri, 1) | ...

View solution in original post

Highlighted

Re: How do I refer to the first, nth or last value of a multivalue field?

Builder

Very cool! Are mv fields sorted by time in a transaction?

0 Karma
Highlighted

Re: How do I refer to the first, nth or last value of a multivalue field?

Legend

hulahoop, the field value ordering is controlled by the "mvlist" parameter of the "transaction" command: http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.