topic help with EVAL command in Splunk Enterprise

help with EVAL command

shreyasamin64 — Fri, 26 Nov 2021 13:24:31 GMT

| eval new_name=mvindex(split(name, ","),0), first name 0 and last name 1

split first and last name

why split and 0&1 used in the pipeline

Re: help with EVAL command

ITWhisperer — Fri, 26 Nov 2021 14:09:26 GMT

split creates a multi-value field, mvindex returns one of the values referenced by the index, 0 in this instance, which is the first value.

Re: help with EVAL command

shreyasamin64 — Fri, 26 Nov 2021 16:08:02 GMT

@ITWhisperer thank you 👍

why do we use ","

Re: help with EVAL command

ITWhisperer — Fri, 26 Nov 2021 16:27:29 GMT

The use of "," was your suggestion. I assume your data has name comma separated, e.g. "John,Smith". If the name is delimited with a different character, you need to change the split command accordingly.

Re: help with EVAL command

shreyasamin64 — Fri, 26 Nov 2021 17:15:10 GMT

yes we use "," in some data's

thank you @ITWhisperer