Splunk Search

How to write a search to only keep a certain type of value for a multivalue field?

dmacgillivray
Communicator

Hello Splunkers,

I have a question about data I am trying to draw from Splunk. If you look at the fields, I am am trying to do something like this.

Table

report_name, report_date, time
AReport 2016-07-08 1:00PM
BReport junkdatakdls;f 2:00PM
CReport morejunkkfkdsd 3:00PM

From the above, how can I ask Splunk to keep only the report_date multivalue field value (Type of YYYY-MM-DD)
I will like to leave the junk data out of that field, but do not want to restrict the count of rows either. So I would like to make any field that is not in a date format of YYYY-MM-DD just blank.

Thanks,
Daniel MacGillivray

0 Karma
1 Solution

sundareshr
Legend

In your search, you can filter out events that do not meet a specific pattern like this

... | regex report_date="\d{4}-\d\d-\d\d"

OR, if report_date is a multivalue field, you can use mvfilter, like this

... | eval report_date=mvfilter(match(report_date, "\d{4}-\d\d-\d\d"))

http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/CommonEvalFunctions#Multivalue_fun...

View solution in original post

sundareshr
Legend

In your search, you can filter out events that do not meet a specific pattern like this

... | regex report_date="\d{4}-\d\d-\d\d"

OR, if report_date is a multivalue field, you can use mvfilter, like this

... | eval report_date=mvfilter(match(report_date, "\d{4}-\d\d-\d\d"))

http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/CommonEvalFunctions#Multivalue_fun...

dmacgillivray
Communicator

Hi Sundareshr,

Thank You ! They both worked equally well. To add to these, I ended up finding some more records in this field than I wanted to see, so what I just added beginning and eol characters for good measure.

| regex report_date="^\d{4}-\d\d-\d\d$"
| eval report_date=mvfilter(match(Report_Date, "^\d{4}-\d\d-\d\d$"))
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...