https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428781#M122652 <P>Hi @bollam,</P> <P>Try this run anywhere search..</P> <PRE><CODE>| makeresults a=1 | eval Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info" | append [ makeresults a1=1 |eval Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz" ] |rex max_match=0 field=Information "details-dist-(?P\w+)" |rex max_match=0 field=Information "details-state-(?P\w+)" |rex max_match=0 field=Information "details-local-(?P\w+)" |eval newField="details-dist-".dist.",details-state-".state.",details-local-".local |fields - dist,local,state </CODE></PRE> Tue, 28 Aug 2018 17:50:16 GMT nadlurinadluri 2018-08-28T17:50:16Z https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428780#M122651 <P>Hello,<BR /> I have got a few events with the fields "Information" and "Name". Few events look like below, and I have many such events.</P> <PRE><CODE>25/08/2018 Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info" , Name="abc" 26/08/2018 Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz" , Name="xyz" </CODE></PRE> <P>The values of the fields are not consistent and it might shuffle the position. <BR /> For an instance, The details-dist-Hyderabad in the first event is at position 1 but in the second event it is in the position 2.</P> <P>I would like to extract the values which contain "details" to a new field and should be placed in a order. So I can use this field for the further extraction.</P> <P>Output should look like below.</P> <PRE><CODE>newField = "details-dist-Hyderabad,details-state-Telangana,details-local-abc" newField = "details-dist-Bangalore,details-state-Karnataka,details-local-xyz" </CODE></PRE> Tue, 28 Aug 2018 16:47:13 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428780#M122651 bollam 2018-08-28T16:47:13Z https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428781#M122652 <P>Hi @bollam,</P> <P>Try this run anywhere search..</P> <PRE><CODE>| makeresults a=1 | eval Information="details-dist-Hyderabad,details-state-Telangana,others-info-testing,details-local-abc,others-testing-info" | append [ makeresults a1=1 |eval Information="details-state-Karnataka,details-dist-Bangalore,others-info-testing,others-testing-info,details-local-xyz" ] |rex max_match=0 field=Information "details-dist-(?P\w+)" |rex max_match=0 field=Information "details-state-(?P\w+)" |rex max_match=0 field=Information "details-local-(?P\w+)" |eval newField="details-dist-".dist.",details-state-".state.",details-local-".local |fields - dist,local,state </CODE></PRE> Tue, 28 Aug 2018 17:50:16 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428781#M122652 nadlurinadluri 2018-08-28T17:50:16Z https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428782#M122653 <P>@nadlurinadluri, It worked, Thanks for the quick help!!</P> Wed, 29 Aug 2018 06:42:34 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428782#M122653 bollam 2018-08-29T06:42:34Z https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428783#M122654 <P>Glad that it helped you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Happy Splunking!! </P> Wed, 29 Aug 2018 17:06:56 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-How-to-split-the-values-and-search-for-specific-words/m-p/428783#M122654 nadlurinadluri 2018-08-29T17:06:56Z