Splunk Dev

two values for same id how to get the second value ?

ravirajaka
Engager

I have a result which shows two values for the same Id and I want the value of the second Id in table

result
class=com.something.something .something [id=requestid=7375de3b-b524-4a4d-85e5-c6b7cb0fb7b1 id=201231]
class=com.something.something .something [id=requestid=70dbdd62-7fd3-4178-a082-f27c0866279a id=151232]
class=com.something.something .something [id=requestid=34b96d23-1340-4f9a-b518-d95b8ae853a5 id=671235]
class=com.something.something .something [id=requestid=1845de3b-a524-1a4d-75e5-a1b7bb1fb7b2 id=921239]

so I want in result 201231,151232,671235,921239

Please help.

Tags (1)

woodcock
Esteemed Legend

Set KV_MODE = auto on your Search Head and then do:

... | eval id2=mvindex(id, 1)
0 Karma

wmyersas
Builder

If the format is consistent, you can do this:

| rex field=result "\[[\S\W]+\sid=(?<second_id>\d+)"

See https://regex101.com/r/p0RcVe/1 to compare this regex

0 Karma

renjith_nair
Legend

@ravirajaka ,

Try

"base search"|rex field="your fieldname" "\bid=(?<second_id>\d+)"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...