https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-specific-field-number-quot-n-quot-from-an-event/m-p/486700#M136125 <P>Here is one way to do it, using a Run Anywhere search:</P> <PRE><CODE>| makeresults | eval yourEvent="12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 22.4 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01" | eval fields=split(yourEvent," ") | eval num=mvindex(fields,12) </CODE></PRE> <P>num=22.4</P> Mon, 13 Jan 2020 19:55:33 GMT jpolvino 2020-01-13T19:55:33Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-specific-field-number-quot-n-quot-from-an-event/m-p/486699#M136124 <P>How to extract a specific field from an event, like "awk '{print $13}'", In this example I want to extract field 13 (22.4):</P> <P>12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 <STRONG>22.4</STRONG> 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01</P> Mon, 13 Jan 2020 19:39:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-specific-field-number-quot-n-quot-from-an-event/m-p/486699#M136124 leifab 2020-01-13T19:39:15Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-specific-field-number-quot-n-quot-from-an-event/m-p/486700#M136125 <P>Here is one way to do it, using a Run Anywhere search:</P> <PRE><CODE>| makeresults | eval yourEvent="12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 22.4 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01" | eval fields=split(yourEvent," ") | eval num=mvindex(fields,12) </CODE></PRE> <P>num=22.4</P> Mon, 13 Jan 2020 19:55:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-specific-field-number-quot-n-quot-from-an-event/m-p/486700#M136125 jpolvino 2020-01-13T19:55:33Z