Splunk Search

how to filter the data from logs

Nith1
Path Finder

Hi Team

i have a field agentId where i can find my data that is required data(i.e)cname=abc ,cname=xyz and so on ,while trying to use the below command

|eval test=mvindex(split(agentId,"\n"),25,40)  

i could see the required data "cname=abc" ,cname=xyz and so on is available in different index postions because of which im unable to filter the data out using mvindex
Can someone guide me with the query

Thanks
sruthi

Labels (5)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can possibly do this with rex

| rex max_match=0 "(?<agentid>cname=\w+)"

If this doesn't work, please could you share some sample events so we can see what you are working with?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Nith1 

Can you please share sample data from `agentId` and also type like multivalued or single value?

 

meanwhile you can try this.

| makeresults count=10 
| eval a=1 
| accum a 
| stats values(a) as agentId 
| eval agentId=mvjoin(agentId,"
")
|rename comment as "Upto Now is sample data only" 
| eval test=mvindex(split(agentId,"
"),2,9)

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...