How to Filter Table Output?

[RahulMisra]

I have an output of

index=feds  | fillnull value="" | table httpRequest.clientIp labels{}.name

awswaf:clientip:geo:country:US

awswaf:managed:token:absent

awswaf:clientip:geo:region:US-IL

awswaf:managed:aws:bot-control:signal:non_browser_user_agent

wswaf:clientip:geo:country:US

awswaf:managed:token:absent

awswaf:clientip:geo:region:US-IL

awswaf:managed:aws:bot-control:signal:non_browser_user_agent

wswaf:clientip:geo:country:US

awswaf:managed:token:absent

awswaf:clientip:geo:region:US-IL

awswaf:managed:aws:bot-control:signal:non_browser_user_agent

But need to filter "awswaf:managed:aws:bot-control:signal:non_browser_user_agent" on Table output and see the results only on "awswaf:managed:aws:bot-control:signal:non_browser_user_agent"

[ITWhisperer]

If it is always the last item of a multivalue field, you could try something like this

index=feds  | fillnull value="" | table httpRequest.clientIp labels{}.name
| rename "labels{}.name" as name
| eval name=mvindex(name, -1)

[RahulMisra]

not always the last 😞

[ITWhisperer]

Does it always start with "awswaf:managed"? Or is there some other way to recognise the part you want displayed?

[RahulMisra]

Always with that String

[ITWhisperer]

You could try extracting just that part from your events. If you want help doing that, you should share some raw events in a code block </> to preserve formatting.