Splunk Search

How to use mvindex to display second field if present, but show first field if not present?

chanthongphiob
Path Finder

I am looking into login logs from different Event IDs. Some events have two fields for Account_Name, while other events have only one Account_Name in their log.

What would my query be if I needed to compensate for either scenarios?

I have performed a query using mvindex(Account_Name, 1) to obtain the second Account_Name in the log. However, I am stuck where if there is no second Account_Name being used. To see if there is an issue, I inserted... | fillnull value=null |

My query is as follow:

index=main (EventCode=4624 OR EventCode=4647 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4770 OR EventCode=4771 OR EventCode=4774 OR EventCode=4776 OR EventCode=4778 OR EventCode=4779) | eval Account_Name=mvindex(Account_Name,1) | fillnull value=NULL | stats count by Account_Name | sort - count

I don't expect to see Null in my results as each Event should have at least one Account_Name.

Thank you in advance for any help.

0 Karma

somesoni2
Revered Legend

Try like this. The mvindex(Account_Name,-1) will take the last item in the Account_Name multivalued field. If there are 2 items, 2nd item is picked and if there is only a single item, same will be returned.

index=main (EventCode=4624 OR EventCode=4647 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4770 OR EventCode=4771 OR EventCode=4774 OR EventCode=4776 OR EventCode=4778 OR EventCode=4779) | eval Account_Name=mvindex(Account_Name,-1)  | stats count by Account_Name | sort - count
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...