How to extract values in a field?

[mdmaala]

In my table, I have a field named Username, and it has two values: Machine 1 and 2. I only want to show Machine1 only without showing Machine2. How would I do this? thanks!

[woodcock]

Like this:

... | eval Username = mvindex(Username, 0)

[mdmaala]

I did this but it still shows both machine 1 and 2

[renjith_nair]

@mdmaala,

Is it a multi value field or delimiter(comma,space,etc) separated? Can you share some sample events of the field?

[richgalloway · Accepted solution]

Add | search Username=Machine1 to your query.

[mdmaala]

I did this and this works! but in my graph it still leaves a gap for machine 2 values for every timestamp registered, is there anyway that I can remove that in the graph and show the values for machine 1 only?

[mdmaala]

thanks! I was able to search only for Machine1 values. but in my graph it still leaves a space for machine 2. I only want to graph values for machine 1