How to extract from multivalue field result

[Noob_splunker]

Hi,

Below is the result from my transaction command. How do I extract only one date from the  multiple dates below?

I only need the first one which is 2020-07-05 22:02:01.

2020-07-05 22:02:01

2020-07-05 22:02:36

2020-07-05 22:02:58

2020-07-06 03:02:41

I tried mvindex and split but it doesnt give me a result.

Thanks,

[renjith_nair · Accepted solution]

@Noob_splunker,

It looks like your field name is the culprit.

Try renaming the field it to start with a letter.

| rename 4G_OutageStart as FG_OutageStart
| eval firstValue=mvindex(FG_OutageStart,0)

[Noob_splunker]

yup it worked after i renamed it! thanks much!

[bowesmana]

Surrounding fields with single quotes ' will ensure eval command works with field names that start with numbers or have spaces in, as in my example

[renjith_nair]

Yes sure

[bowesmana]

Split and mvindex should work, try this

| makeresults
| eval 4G_OutageStart="2020-07-05 22:02:01,2020-07-05 22:02:36,2020-07-05 22:02:58,2020-07-06 03:02:41"
| eval 4G_OutageStart=split('4G_OutageStart',",")
| eval DataPoints=mvcount('4G_OutageStart')
| eval FirstDateTime=mvindex('4G_OutageStart',0,0)

If things are not working, it may be that your data looks like an MV field, but is not. You can check with the mvcount eval statement I included above.