Duplicate field in Splunk Events

Question

I have a very strange issue, in the same event there are two different values for the same field in the below format a.b.c="" and a.b.c="qwe123df".I need to get the second value but when listing, first value is getting selected which is empty.Is there some way to get the non-empty value for this field? Remember '.' means concatenate in Splunk.I have tried to use rex but no luck.

Answer 1

It's the field multi valued? If so, you can use eval field=mvindex(a.b.c,1) (multi value fields start at 0, so this will get the 2nd value)

Alternatively, you can use rex to only match for at least one character. rex field=_raw "a.b.c=\"(?<value>.+)\""