topic Splunk Lastname firstname formating in Getting Data In

Splunk Lastname firstname formating

arunsundarm — Tue, 16 Jul 2019 13:31:29 GMT

I am using this query to fetch current logged in user "|rest splunk_server=local /services/authentication/current-context | fields realname"
It displays real name as Lastname, Firstname
Now i want a nother field with value "Firstname Lastname" format

Re: Splunk Lastname firstname formating

richgalloway — Tue, 16 Jul 2019 14:57:25 GMT

Try rex.

... | eval name=realname | rex field=name mode=sed "s/([^,]+), (.*)/\2 \1/"

Re: Splunk Lastname firstname formating

Nextbeat — Tue, 14 Apr 2020 16:39:24 GMT

Thanks for reminding me that Sed can do this, but was originally curious about the eval way.

Re: Splunk Lastname firstname formating

to4kawa — Wed, 15 Apr 2020 10:21:05 GMT

... | eval name=mvindex(split(realname,","),1).",".mvindex(split(realname,","),0)