Splunk Search

How to combine mv field values into string

c_o_serban
Engager

I have a string field that I split into a variable-length multi-value, removed the last value and need to combine it back to a string value. The search below doesn't seem to work
e.g.:
url
/user/v1/group/status/313
/prov/provisioning/v1/group/30863

search:

eval n_url= split(url, "/") |eval o_url=(mvindex(n_url,1,mvcount(n_url)-2)) |mvcombine delim="/" n_url | nomv n_url | table url, m_url, o_url
0 Karma

mayurr98
Super Champion

Why don't you try this?

| makeresults 
| eval url="/user/v1/group/status/313 /prov/provisioning/v1/group/30863" 
| makemv url 
| mvexpand url 
| rex field=url mode=sed "s/(.*)(\/\d+)/\1/g"

By your method you should try

| eval n_url= split(url, "/") 
| eval o_url=(mvindex(n_url,1,mvcount(n_url)-2)) 
| mvexpand o_url 
| mvcombine delim="/" o_url 
| nomv o_url 
| table url o_url n_url
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...