Splunk Search

How to write a search to only keep a certain type of value for a multivalue field?

dmacgillivray
Communicator

Hello Splunkers,

I have a question about data I am trying to draw from Splunk. If you look at the fields, I am am trying to do something like this.

Table

report_name, report_date, time
AReport 2016-07-08 1:00PM
BReport junkdatakdls;f 2:00PM
CReport morejunkkfkdsd 3:00PM

From the above, how can I ask Splunk to keep only the report_date multivalue field value (Type of YYYY-MM-DD)
I will like to leave the junk data out of that field, but do not want to restrict the count of rows either. So I would like to make any field that is not in a date format of YYYY-MM-DD just blank.

Thanks,
Daniel MacGillivray

0 Karma
1 Solution

sundareshr
Legend

In your search, you can filter out events that do not meet a specific pattern like this

... | regex report_date="\d{4}-\d\d-\d\d"

OR, if report_date is a multivalue field, you can use mvfilter, like this

... | eval report_date=mvfilter(match(report_date, "\d{4}-\d\d-\d\d"))

http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/CommonEvalFunctions#Multivalue_fun...

View solution in original post

sundareshr
Legend

In your search, you can filter out events that do not meet a specific pattern like this

... | regex report_date="\d{4}-\d\d-\d\d"

OR, if report_date is a multivalue field, you can use mvfilter, like this

... | eval report_date=mvfilter(match(report_date, "\d{4}-\d\d-\d\d"))

http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/CommonEvalFunctions#Multivalue_fun...

dmacgillivray
Communicator

Hi Sundareshr,

Thank You ! They both worked equally well. To add to these, I ended up finding some more records in this field than I wanted to see, so what I just added beginning and eol characters for good measure.

| regex report_date="^\d{4}-\d\d-\d\d$"
| eval report_date=mvfilter(match(Report_Date, "^\d{4}-\d\d-\d\d$"))
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...