Splunk Search

How to Filter Table Output?

RahulMisra
Engager

I have an output of

 

index=feds  | fillnull value="" | table httpRequest.clientIp labels{}.name

awswaf:clientip:geo:country:US
awswaf:managed:token:absent
awswaf:clientip:geo:region:US-IL
awswaf:managed:aws:bot-control:signal:non_browser_user_agent
 
wswaf:clientip:geo:country:US
awswaf:managed:token:absent
awswaf:clientip:geo:region:US-IL
awswaf:managed:aws:bot-control:signal:non_browser_user_agent
 
wswaf:clientip:geo:country:US
awswaf:managed:token:absent
awswaf:clientip:geo:region:US-IL
awswaf:managed:aws:bot-control:signal:non_browser_user_agent
 
But need to filter "awswaf:managed:aws:bot-control:signal:non_browser_user_agent" on Table output and see the results only on "awswaf:managed:aws:bot-control:signal:non_browser_user_agent"
Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If it is always the last item of a multivalue field, you could try something like this

index=feds  | fillnull value="" | table httpRequest.clientIp labels{}.name
| rename "labels{}.name" as name
| eval name=mvindex(name, -1)
0 Karma

RahulMisra
Engager

not always the last 😞

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does it always start with "awswaf:managed"? Or is there some other way to recognise the part you want displayed?

0 Karma

RahulMisra
Engager

Always with that String

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try extracting just that part from your events. If you want help doing that, you should share some raw events in a code block </> to preserve formatting.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...