CODEWITHSUNDEEP
splunksplunk-query
does_it_matter
does_it_matter

Reputation: 620

Duplicate field in Splunk Events

I have a very strange issue, in the same event there are two different values for the same field in the below format a.b.c="" and a.b.c="qwe123df".I need to get the second value but when listing, first value is getting selected which is empty.Is there some way to get the non-empty value for this field? Remember '.' means concatenate in Splunk.I have tried to use rex but no luck.

Upvotes: 0

Views: 2891

Answers (1)

Simon Duff
Simon Duff

Reputation: 2651

It's the field multi valued? If so, you can use eval field=mvindex(a.b.c,1) (multi value fields start at 0, so this will get the 2nd value)

Alternatively, you can use rex to only match for at least one character. rex field=_raw "a.b.c=\"(?<value>.+)\""

Upvotes: 1

Related Questions