Splunk Search
Highlighted

Wildcard lookup returns more than one value

New Member

So I have a regex:

rex field=requestUrl "^\w+:\/\/[^\/]+\/(?<uri>.+)$"

And then I use the value of that in a lookup

lookup uri-operationName uri as uri, verb as httpMethod OUTPUTNEW operationName as operationName

Works great, most of the time. As you can see below, if I search for an operationName of "Get Tenders By Account ID" I get results with both operationNames.

uri verb operationName
service-name/accounts/* GET Get By Account ID
service-name/accounts/*/tenders GET Get Tenders By Account ID

How would I go about fixing that within either the regex, search or lookup?

0 Karma
Highlighted

Re: Wildcard lookup returns more than one value

New Member
eval operationName=mvindex(operationName,0)

This appears to get the most specific match. If anyone has info about mvindex returning the most specific rex value in some official documentation, I'd appreciate it.

0 Karma