Splunk Search

distinct first n characters of string

reverse
Contributor

Lets say .. My result would produce

a.log
a.log.1
a.log.2
a.log.3
b.log
b.log.1
b.log.2
b.log.3
c.log
c.log.1
c.log.2
c.log.3 

I want the final result as

a.log
b.log
c.log

Thoughts ?

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Try this run anywhere search

| makeresults | eval field1="a.log a.log1 a.log2 a.log3 " | makemv field1 | mvexpand field1 | appendcols [| makeresults | eval field2="b.log b.log1 b.log2 b.log3 " | makemv field2 | mvexpand field2] | replace a.log* WITH a.log IN field1 | replace b.log* WITH b.log IN field2

Try

| replace a.log* WITH a.log IN fieldname| replace b.log* WITH b.log IN fieldname | so on

replace documentation:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Replace

OR another way is

|eval field1=replace(field1,"(a.log).*","\1"), field2=replace(field2,"(b.log).*","\1"), so on

View solution in original post

mayurr98
Super Champion

Try this run anywhere search

| makeresults | eval field1="a.log a.log1 a.log2 a.log3 " | makemv field1 | mvexpand field1 | appendcols [| makeresults | eval field2="b.log b.log1 b.log2 b.log3 " | makemv field2 | mvexpand field2] | replace a.log* WITH a.log IN field1 | replace b.log* WITH b.log IN field2

Try

| replace a.log* WITH a.log IN fieldname| replace b.log* WITH b.log IN fieldname | so on

replace documentation:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Replace

OR another way is

|eval field1=replace(field1,"(a.log).*","\1"), field2=replace(field2,"(b.log).*","\1"), so on

reverse
Contributor

but this wont help as there are 70 varieties of logs

0 Karma

mayurr98
Super Champion

Try something like this..

| makeresults | eval field1="a.log a.log1 a.log2 a.log3 " | makemv field1 | mvexpand field1 | appendcols [| makeresults | eval field2="b.log b.log1 b.log2 b.log3 " | makemv field2 | mvexpand field2] | table field1 field2| foreach field* [eval <<FIELD>>=replace(<<FIELD>>,"^(\w+)(.log).*","\1\2")]

This will do for each and every fieldsfield*

| foreach field* [eval <<FIELD>>=replace(<<FIELD>>,"^(\w+)(.log).*","\1\2")]

0 Karma

reverse
Contributor

It worked!!!!!!! Thank you!!!!!

0 Karma

mayurr98
Super Champion

are these fields or values?

0 Karma

reverse
Contributor

@mayurr98 · these are values

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...