https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339424#M100661 <P>Hello -</P> <P>I'm trying to extract a field from a CSV. The problem is the 9th position can have several different values. I need the field for the "700 Auth_Method_success" value. When I set up the field, I'm getting the "70..." alone with all the other possible values. </P> <P>EXAMPLE</P> <PRE><CODE>246436066,Application,SSH Tectia Server,INFORMATION,abc.def.ghi.com,9/13/2017 9:28:55 AM,0,None,"700 Auth_method_success, Username: custdm10/ECS-40ZV, </CODE></PRE> <P>Thanks.</P> <P>Carl</P> Tue, 29 Sep 2020 15:47:15 GMT johnca00 2020-09-29T15:47:15Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339424#M100661 <P>Hello -</P> <P>I'm trying to extract a field from a CSV. The problem is the 9th position can have several different values. I need the field for the "700 Auth_Method_success" value. When I set up the field, I'm getting the "70..." alone with all the other possible values. </P> <P>EXAMPLE</P> <PRE><CODE>246436066,Application,SSH Tectia Server,INFORMATION,abc.def.ghi.com,9/13/2017 9:28:55 AM,0,None,"700 Auth_method_success, Username: custdm10/ECS-40ZV, </CODE></PRE> <P>Thanks.</P> <P>Carl</P> Tue, 29 Sep 2020 15:47:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339424#M100661 johnca00 2020-09-29T15:47:15Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339425#M100662 <P>@johnca00, you need to add more details for your question and example.</P> <P>Do you have issue with field name or field value at 9th position?<BR /> What are some of the different samples for 9th position?<BR /> Does it start with double quotes and does not have an ending double quote?</P> <P><CODE>"700 Auth_method_success,</CODE><BR /> Please also explain what you mean by <CODE>I'm getting the "70..." alone with all the other possible values</CODE></P> Fri, 15 Sep 2017 02:13:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339425#M100662 niketn 2017-09-15T02:13:38Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339426#M100663 <P>Hello - </P> <P>Sorry for the typo. During the extract I see just the '700 Auth...." When I add the field to my search I'm see all the possible values. </P> Fri, 15 Sep 2017 10:14:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339426#M100663 johnca00 2017-09-15T10:14:54Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339427#M100664 <P>Sorry for the typo. During the field extract I'm seeing only the '700 auth....'. When I put the field into a search it's returning all possible values, not just the '700 auth...' </P> Fri, 15 Sep 2017 10:30:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339427#M100664 johnca00 2017-09-15T10:30:00Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339428#M100665 <P>how are you extracting the field?<BR /> Why can't you just use a , as delimiter since all fields are separated by commas in your sample. You can then rename field9 as whatever you want during extraction. I think you might have tried using regex extraction from the web and selected just '700 auth' field as a sample. This will only return this specific value only.</P> Fri, 15 Sep 2017 17:27:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-in-a-CSV-where-the-field-position-can/m-p/339428#M100665 Sukisen1981 2017-09-15T17:27:21Z