How to extract all unique values from a multivalue field in one event?

[edrivera3]

Hi

I want to extract field values that are distinct in one event. I managed to extract all the field values in the event, but I don't want those that repeat themselves.

...| rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0

[ngatchasandra]

Hi edrivera3,

Try with mvindex function, this will retrieve all values field like follow:

 ...| rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 |eval color1=mvindex( color_casa,0) |eval color2=mvindex( color_casa,1) |eval color3=mvindex( color_casa,2) |... |table color1 color2 color3 ...

[edrivera3]

I have more than thirty values in each event and the amount of values is different for each event. Thanks anyway for your answer.

[acharlieh · Accepted solution]

Looking at the functions for eval, I would guess that

    ... | rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 | eval color_casa=mvdedup(color_casa)

should do the trick. If not that then:

    ... | rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 | eval color_casa=mvdedup(mvsort(color_casa))

[edrivera3]

Do you know how I could do the same but with the configuration file? (No inline)

[acharlieh]

Assuming you're using field extraction to create the multivalued field, you may be able to use a calculated field to tweak it's value, but it's something you'd need to play with to know for certain.