Splunk Search

How to filter a single value from a Multivalue of a field in the same event?

singhbc
Path Finder

10.10.10.10 - - ProfileID=CRTClientAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=SDGUser 1,ProductCode=SDG,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=4MEUser 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=NASOne 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=CRTClientPrefAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=Certificate 1,ProductCode=HRIIPortal,ou=products,o=cyH,ou=clients,o=a.com denise [13/Jan/2014:13:05:03 -0500] "GET /acognos/cgi-bin/modcognos?b_action=xts.run&m=portal/logoff.xts&h_CAM_action=logoff&dojo.preventCache=1389636315984 HTTP/1.1" 200 3779 18558 4072147824

I would like to extract only the relevant values of the field o in the above sample log. For example I only need o=cyH and rest of the values of o need to be discarded.

Thanks in advance.

Tags (1)

somesoni2
Revered Legend

Try this

..your base search..| rex max_match=0 "(?m)o=(?<OValue>[^,][^com]+)," | mvexpand OValue | dedup OValue

singhbc
Path Finder

Thanks for your answer, and Yes I would like to only extract non .com values for o and distinct values as well since there are multiple instances of o=cyH in the same event and other events as well.

0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

Considering there are many "o=" in your log sample, you need to at least tell us the rule for identifying the "winner." Is it the very first o=? Is it any o= that's not a .com value? Or do you want one exacted value for o=cyH and one for o=a.com which essentially is asking for a dedup'ed MV (or a set of o= values)?

0 Karma

wpreston
Motivator

Try this:

...your search... | rex "o=(?<FieldO>cyH)"

Or, if you want it to be persistent, you can add the extraction into props.conf or transforms.conf.

0 Karma

singhbc
Path Finder

Thats fine if there is only one event, what if I have multiple events and there are different values of o in each event but I still want to extract one unique value from each event for example, o=dyH from event 2 and o=eyH from event 3 and so on. Provided all events look the same as I have shown above. Thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...