Splunk Search

How do I refer to the first, nth or last value of a multivalue field?

cfrln
Explorer

I am using the transaction command to sessionize web access log events and therefore have made referer, uri etc. into multivalue fields. How do I report on the first value of referer? The second page visited? The exit page?

Tags (2)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the mvindex eval function that's described in: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

As an example: ... | eval second_uri = mvindex(uri, 1) | ...

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the mvindex eval function that's described in: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

As an example: ... | eval second_uri = mvindex(uri, 1) | ...

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

hulahoop, the field value ordering is controlled by the "mvlist" parameter of the "transaction" command: http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

hulahoop
Splunk Employee
Splunk Employee

Very cool! Are mv fields sorted by time in a transaction?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!