Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

How to filter a single value from a Multivalue of a field in the same event?

$
0
0

10.10.10.10 - - ProfileID=CRTClientAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=SDGUser 1,ProductCode=SDG,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=4MEUser 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=NASOne 1,ProductCode=4ME,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=CRTClientPrefAdmin 1,ProductCode=CRT,ou=products,o=cyH,ou=clients,o=a.com^ProfileID=Certificate 1,ProductCode=HRIIPortal,ou=products,o=cyH,ou=clients,o=a.com denise [13/Jan/2014:13:05:03 -0500] "GET /acognos/cgi-bin/modcognos?b_action=xts.run&m=portal/logoff.xts&h_CAM_action=logoff&dojo.preventCache=1389636315984 HTTP/1.1" 200 3779 18558 4072147824

I would like to extract only the relevant values of the field o in the above sample log. For example I only need o=cyH and rest of the values of o need to be discarded.

Thanks in advance.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>