Splunk Search

Take the first value of each multivalue field

sbsbb
Builder

I have a big xml I wan't to make flat :

element1
...
subelement1
 subelement1.1
 subelement1.2
subelement2
 subelement2.1
 subelement2.2

If I make an spath, let say at subelement, I have all the subelements as multivalue.
With nomv, I'm able to convert mvfields into singlevalue, but the content contains all the values...
What I want, is having only the first value from the mvfields...

I have lot of them, so I don't wan't to make an spath, with a path for each...

Tags (4)
1 Solution

kristian_kolb
Ultra Champion
... | eval my_number_1 = mvindex(my_multivalue_field, 0)

See more about the mv*() functions here;

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

View solution in original post

kristian_kolb
Ultra Champion
... | eval my_number_1 = mvindex(my_multivalue_field, 0)

See more about the mv*() functions here;

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...