Splunk Search

How to extract the first field of a list with space and slash?

anissabnk
Path Finder

Hello everyone, 

I have a problem with a request. 

I tried with this: 

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

It works only for the line that contains a slash. 

I don't know how to process to have the first field extracted for all the results. 

Thank you so much for your help

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss
0 Karma

anissabnk
Path Finder

Thank youuuu so much @ITWhisperer 

0 Karma

anissabnk
Path Finder

 

 

0 Karma

anissabnk
Path Finder

.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @anissabnk,

could you share the raw source of your data?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...