Splunk Search

How to combine mv field values into string


I have a string field that I split into a variable-length multi-value, removed the last value and need to combine it back to a string value. The search below doesn't seem to work


eval n_url= split(url, "/") |eval o_url=(mvindex(n_url,1,mvcount(n_url)-2)) |mvcombine delim="/" n_url | nomv n_url | table url, m_url, o_url
0 Karma

Super Champion

Why don't you try this?

| makeresults 
| eval url="/user/v1/group/status/313 /prov/provisioning/v1/group/30863" 
| makemv url 
| mvexpand url 
| rex field=url mode=sed "s/(.*)(\/\d+)/\1/g"

By your method you should try

| eval n_url= split(url, "/") 
| eval o_url=(mvindex(n_url,1,mvcount(n_url)-2)) 
| mvexpand o_url 
| mvcombine delim="/" o_url 
| nomv o_url 
| table url o_url n_url
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!