Splunk Search

How to use rex max_match resulting in only unique values

spencerneal
Explorer

Hello,

 

I am trying to get a list of values using max_match=5.  However I need the results to only return unique values and not just list 5 values regardless of them being duplicates.

| rex max_match=5 (?P<BrandID>(202\d.+?))\"

|table BrandID

Your help and energy is greatly appreciated.  🙂

Thank you,

Spencer Neal

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That's not what rex does.  It just matches patterns.  If you need unique results, then insert the mvdedup function into your query.

```Get all BrandID values```
| rex max_match=0 (?P<BrandID>(202\d.+?))\"
```Filter out duplicate values ```
| eval BrandID=mvdedup(BrandID)
```Keep only the first 5 unique values```
| eval BrandID=mvindex(BrandID, 0 4)
| table BrandID

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

spencerneal
Explorer

Rich,

Thank you greatly for taking the time to help me out!!  :). Your code did the trick!!  

Thank you,

Please take care.

Spencer

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

That's not what rex does.  It just matches patterns.  If you need unique results, then insert the mvdedup function into your query.

```Get all BrandID values```
| rex max_match=0 (?P<BrandID>(202\d.+?))\"
```Filter out duplicate values ```
| eval BrandID=mvdedup(BrandID)
```Keep only the first 5 unique values```
| eval BrandID=mvindex(BrandID, 0 4)
| table BrandID

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...