Splunk Search

How to extract the first field of a list with space and slash?

anissabnk
Path Finder

Hello everyone, 

I have a problem with a request. 

I tried with this: 

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

It works only for the line that contains a slash. 

I don't know how to process to have the first field extracted for all the results. 

Thank you so much for your help

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss
0 Karma

anissabnk
Path Finder

Thank youuuu so much @ITWhisperer 

0 Karma

anissabnk
Path Finder

 

 

0 Karma

anissabnk
Path Finder

.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @anissabnk,

could you share the raw source of your data?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...