Splunk Search

Take the first value of each multivalue field

sbsbb
Builder

I have a big xml I wan't to make flat :

element1
...
subelement1
 subelement1.1
 subelement1.2
subelement2
 subelement2.1
 subelement2.2

If I make an spath, let say at subelement, I have all the subelements as multivalue.
With nomv, I'm able to convert mvfields into singlevalue, but the content contains all the values...
What I want, is having only the first value from the mvfields...

I have lot of them, so I don't wan't to make an spath, with a path for each...

Tags (4)
1 Solution

kristian_kolb
Ultra Champion
... | eval my_number_1 = mvindex(my_multivalue_field, 0)

See more about the mv*() functions here;

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

View solution in original post

kristian_kolb
Ultra Champion
... | eval my_number_1 = mvindex(my_multivalue_field, 0)

See more about the mv*() functions here;

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...