Hi
I want to extract field values that are distinct in one event. I managed to extract all the field values in the event, but I don't want those that repeat themselves.
...| rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0
Looking at the functions for eval, I would guess that
... | rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 | eval color_casa=mvdedup(color_casa)
should do the trick. If not that then:
... | rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 | eval color_casa=mvdedup(mvsort(color_casa))
Hi edrivera3,
Try with mvindex function, this will retrieve all values field like follow:
...| rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 |eval color1=mvindex( color_casa,0) |eval color2=mvindex( color_casa,1) |eval color3=mvindex( color_casa,2) |... |table color1 color2 color3 ...
I have more than thirty values in each event and the amount of values is different for each event. Thanks anyway for your answer.
Looking at the functions for eval, I would guess that
... | rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 | eval color_casa=mvdedup(color_casa)
should do the trick. If not that then:
... | rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 | eval color_casa=mvdedup(mvsort(color_casa))
Do you know how I could do the same but with the configuration file? (No inline)
Assuming you're using field extraction to create the multivalued field, you may be able to use a calculated field to tweak it's value, but it's something you'd need to play with to know for certain.