how to filter the data from logs

[Nith1]

Hi Team

i have a field agentId where i can find my data that is required data(i.e)cname=abc ,cname=xyz and so on ,while trying to use the below command

|eval test=mvindex(split(agentId,"\n"),25,40)  

i could see the required data "cname=abc" ,cname=xyz and so on is available in different index postions because of which im unable to filter the data out using mvindex
Can someone guide me with the query

Thanks
sruthi

[ITWhisperer]

You can possibly do this with rex

| rex max_match=0 "(?<agentid>cname=\w+)"

If this doesn't work, please could you share some sample events so we can see what you are working with?

[kamlesh_vaghela]

@Nith1 

Can you please share sample data from `agentId` and also type like multivalued or single value?

meanwhile you can try this.

| makeresults count=10 
| eval a=1 
| accum a 
| stats values(a) as agentId 
| eval agentId=mvjoin(agentId,"
")
|rename comment as "Upto Now is sample data only" 
| eval test=mvindex(split(agentId,"
"),2,9)

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.