Splunk Search

How to filter a single value from a Multivalue of a field in the same event?

singhbc
Path Finder

10.10.10.10 - - ProfileID=CRTClientAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=SDGUser 1,ProductCode=SDG,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=4MEUser 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=NASOne 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=CRTClientPrefAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=Certificate 1,ProductCode=HRIIPortal,ou=products,o=cyH,ou=clients,o=a.com denise [13/Jan/2014:13:05:03 -0500] "GET /acognos/cgi-bin/modcognos?b_action=xts.run&m=portal/logoff.xts&h_CAM_action=logoff&dojo.preventCache=1389636315984 HTTP/1.1" 200 3779 18558 4072147824

I would like to extract only the relevant values of the field o in the above sample log. For example I only need o=cyH and rest of the values of o need to be discarded.

Thanks in advance.

Tags (1)

somesoni2
Revered Legend

Try this

..your base search..| rex max_match=0 "(?m)o=(?<OValue>[^,][^com]+)," | mvexpand OValue | dedup OValue

singhbc
Path Finder

Thanks for your answer, and Yes I would like to only extract non .com values for o and distinct values as well since there are multiple instances of o=cyH in the same event and other events as well.

0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

Considering there are many "o=" in your log sample, you need to at least tell us the rule for identifying the "winner." Is it the very first o=? Is it any o= that's not a .com value? Or do you want one exacted value for o=cyH and one for o=a.com which essentially is asking for a dedup'ed MV (or a set of o= values)?

0 Karma

wpreston
Motivator

Try this:

...your search... | rex "o=(?<FieldO>cyH)"

Or, if you want it to be persistent, you can add the extraction into props.conf or transforms.conf.

0 Karma

singhbc
Path Finder

Thats fine if there is only one event, what if I have multiple events and there are different values of o in each event but I still want to extract one unique value from each event for example, o=dyH from event 2 and o=eyH from event 3 and so on. Provided all events look the same as I have shown above. Thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...