Splunk Search

How to extract the first field of a list with space and slash?

anissabnk
Path Finder

Hello everyone, 

I have a problem with a request. 

I tried with this: 

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

It works only for the line that contains a slash. 

I don't know how to process to have the first field extracted for all the results. 

Thank you so much for your help

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the stats to collect the values

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" |eval ss=mvindex(split('Entité (complète)',"/"),0) |stats count by ss

or expand the collection before the mvindex

index="main" sourcetype="st_easyvista_generic" "Identifiant réseau"="PCW-*" Statut="En Service" |dedup "Identifiant réseau" | stats values(Entité (complète)) as entité |mvexpand entité |eval ss=mvindex(split(entité,"/"),0) |stats count by ss
0 Karma

anissabnk
Path Finder

Thank youuuu so much @ITWhisperer 

0 Karma

anissabnk
Path Finder

 

 

0 Karma

anissabnk
Path Finder

.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @anissabnk,

could you share the raw source of your data?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...