Splunk Search

How to filter a single value from a Multivalue of a field in the same event?

singhbc
Path Finder

10.10.10.10 - - ProfileID=CRTClientAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=SDGUser 1,ProductCode=SDG,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=4MEUser 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=NASOne 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=CRTClientPrefAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=Certificate 1,ProductCode=HRIIPortal,ou=products,o=cyH,ou=clients,o=a.com denise [13/Jan/2014:13:05:03 -0500] "GET /acognos/cgi-bin/modcognos?b_action=xts.run&m=portal/logoff.xts&h_CAM_action=logoff&dojo.preventCache=1389636315984 HTTP/1.1" 200 3779 18558 4072147824

I would like to extract only the relevant values of the field o in the above sample log. For example I only need o=cyH and rest of the values of o need to be discarded.

Thanks in advance.

Tags (1)

somesoni2
SplunkTrust
SplunkTrust

Try this

..your base search..| rex max_match=0 "(?m)o=(?<OValue>[^,][^com]+)," | mvexpand OValue | dedup OValue

singhbc
Path Finder

Thanks for your answer, and Yes I would like to only extract non .com values for o and distinct values as well since there are multiple instances of o=cyH in the same event and other events as well.

0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

Considering there are many "o=" in your log sample, you need to at least tell us the rule for identifying the "winner." Is it the very first o=? Is it any o= that's not a .com value? Or do you want one exacted value for o=cyH and one for o=a.com which essentially is asking for a dedup'ed MV (or a set of o= values)?

0 Karma

wpreston
Motivator

Try this:

...your search... | rex "o=(?<FieldO>cyH)"

Or, if you want it to be persistent, you can add the extraction into props.conf or transforms.conf.

0 Karma

singhbc
Path Finder

Thats fine if there is only one event, what if I have multiple events and there are different values of o in each event but I still want to extract one unique value from each event for example, o=dyH from event 2 and o=eyH from event 3 and so on. Provided all events look the same as I have shown above. Thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...