Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Multivalue Extraction

$
0
0
I have the following set of data within each event: stack_trace: [ [-] { [-] class_name: FOO file_name: BAR line_number: -2 method_name: WALK } { [-] class_name: FOO2 file_name: BAR2 line_number: 1356 method_name: JUMP } { [-] class_name: FOO file_name: BAR line_number: 808 method_name: SKIP } ] I want to extract only the first method_name within the stack (| spath "stack_trace{}.method_name" | search "stack_trace{}.method_name"=WALK), which can change from event to event. I've tried using mvindex but I'm having no success. Any suggestions would be greatly appreciated.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>