Splunk Search

makemv and mvindex not working as expected

ankit
Explorer

I am working with JSON data type events and am trying to extract the username (user1, user2) from the pathspec data structure in my events (sample below) :

"pathspec": {"__type__": "PathSpec", "location": "/media/APA_windows/Users/user1/AppData/Local/Microsoft/Windows/UsrClass.dat", "type_indicator": "OS"}

"pathspec": {"__type__": "PathSpec", "location": "/media/APA_windows/Users/user2/AppData/Local/Microsoft/Windows/UsrClass.dat", "type_indicator": "OS"}

I am using the below SPL to split up pathspec.location into a multi value field and then use mvindex : 

 

.....  | makemv delim="/" pathspec.location
| eval user_name = mvindex(pathspec.location, 3) 

 


However when I table out the user_name field it does not show any results. Not sure why this is not working. Any suggestions would be helpful 

Desired output from the user_name field would be 

 

user1
user2
.
.
.
.
.

 

 

 

 

 

Labels (3)
Tags (3)
0 Karma
1 Solution

tscroggins
Influencer

@ankit 

Field names containing special characters should be surrounded with single quotes when used in eval expressions:

| eval user_name = mvindex('pathspec.location', 3)

View solution in original post

ankit
Explorer

Awesome ! That worked @tscroggins ! Thanks a lot for helping out. 
Could you point me to a link, if possible, to what Splunk considers as special characters ? 

0 Karma

tscroggins
Influencer

@ankit 

The exact wording in documentation [1] (emphasis Splunk's):

If the expression references a field name that contains non-alphanumeric characters, other than the underscore ( _ ) character, the field name needs to be surrounded by single quotation marks. For example, if the field name is server-1 you specify the field name like this new=count+'server-1'.

I.e. Any character other then 0-9, A-Z, a-z, and _.

1. https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Eval

tscroggins
Influencer

@ankit 

Field names containing special characters should be surrounded with single quotes when used in eval expressions:

| eval user_name = mvindex('pathspec.location', 3)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...