Splunk Search

How to extract the first field of a list with space and slash?

anissabnk
Path Finder

Hello everyone, 

I have a problem with a request. 

I tried with this: 

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

It works only for the line that contains a slash. 

I don't know how to process to have the first field extracted for all the results. 

Thank you so much for your help

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss
0 Karma

anissabnk
Path Finder

Thank youuuu so much @ITWhisperer 

0 Karma

anissabnk
Path Finder

 

 

0 Karma

anissabnk
Path Finder

.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @anissabnk,

could you share the raw source of your data?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...