Splunk Search

how to filter the data from logs

Path Finder

Hi Team

i have a field agentId where i can find my data that is required data(i.e)cname=abc ,cname=xyz and so on ,while trying to use the below command

|eval test=mvindex(split(agentId,"\n"),25,40)  

i could see the required data "cname=abc" ,cname=xyz and so on is available in different index postions because of which im unable to filter the data out using mvindex
Can someone guide me with the query


Labels (5)
Tags (1)
0 Karma


You can possibly do this with rex

| rex max_match=0 "(?<agentid>cname=\w+)"

If this doesn't work, please could you share some sample events so we can see what you are working with?

0 Karma



Can you please share sample data from `agentId` and also type like multivalued or single value?


meanwhile you can try this.

| makeresults count=10 
| eval a=1 
| accum a 
| stats values(a) as agentId 
| eval agentId=mvjoin(agentId,"
|rename comment as "Upto Now is sample data only" 
| eval test=mvindex(split(agentId,"



If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...