How to filter a single value from a Multivalue of a field in the same event?

[singhbc]

10.10.10.10 - - ProfileID=CRTClientAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=SDGUser 1,ProductCode=SDG,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=4MEUser 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=NASOne 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=CRTClientPrefAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=Certificate 1,ProductCode=HRIIPortal,ou=products,o=cyH,ou=clients,o=a.com denise [13/Jan/2014:13:05:03 -0500] "GET /acognos/cgi-bin/modcognos?b_action=xts.run&m=portal/logoff.xts&h_CAM_action=logoff&dojo.preventCache=1389636315984 HTTP/1.1" 200 3779 18558 4072147824

I would like to extract only the relevant values of the field o in the above sample log. For example I only need o=cyH and rest of the values of o need to be discarded.

Thanks in advance.

[somesoni2]

Try this

..your base search..| rex max_match=0 "(?m)o=(?<OValue>[^,][^com]+)," | mvexpand OValue | dedup OValue

[singhbc]

Thanks for your answer, and Yes I would like to only extract non .com values for o and distinct values as well since there are multiple instances of o=cyH in the same event and other events as well.

[jsie_splunk]

Considering there are many "o=" in your log sample, you need to at least tell us the rule for identifying the "winner." Is it the very first o=? Is it any o= that's not a .com value? Or do you want one exacted value for o=cyH and one for o=a.com which essentially is asking for a dedup'ed MV (or a set of o= values)?

[wpreston]

Try this:

...your search... | rex "o=(?<FieldO>cyH)"

Or, if you want it to be persistent, you can add the extraction into props.conf or transforms.conf.

[singhbc]

Thats fine if there is only one event, what if I have multiple events and there are different values of o in each event but I still want to extract one unique value from each event for example, o=dyH from event 2 and o=eyH from event 3 and so on. Provided all events look the same as I have shown above. Thanks for your answer.