Splunk Search

How to extract the first field of a list with space and slash?

anissabnk
Path Finder

Hello everyone, 

I have a problem with a request. 

I tried with this: 

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

It works only for the line that contains a slash. 

I don't know how to process to have the first field extracted for all the results. 

Thank you so much for your help

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss
0 Karma

anissabnk
Path Finder

Thank youuuu so much @ITWhisperer 

0 Karma

anissabnk
Path Finder

 

 

0 Karma

anissabnk
Path Finder

.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @anissabnk,

could you share the raw source of your data?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...