https://community.splunk.com/t5/Splunk-Search/How-can-I-split-delimit-and-select-only-certain-value/m-p/532323#M150376 <P><SPAN><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;That worked!. Thank you. Upvoted.</SPAN></P> Tue, 08 Dec 2020 12:18:17 GMT satheeshkumar55 2020-12-08T12:18:17Z https://community.splunk.com/t5/Splunk-Search/How-can-I-split-delimit-and-select-only-certain-value/m-p/532084#M150309 <P>IP Field in IIS log is like below.</P><P>100.30.24.56,+11.44.66.778,+120.33.44.15,12.567.89.666</P><P>I want to get only the IP before first comma. (100.30.24.56 in this case).&nbsp;</P><P>Tried something like below but no luck.</P><P>eval IP=split(IP,",")</P> Fri, 04 Dec 2020 23:20:04 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-split-delimit-and-select-only-certain-value/m-p/532084#M150309 satheeshkumar55 2020-12-04T23:20:04Z https://community.splunk.com/t5/Splunk-Search/How-can-I-split-delimit-and-select-only-certain-value/m-p/532088#M150312 <P>You were halfway there.&nbsp; The split function returns a multi-value field.&nbsp; The next step is to extract the first entry in that multi-value field.</P><LI-CODE lang="markup">| eval IP=split(IP,",") | eval IP=mvindex(IP, 0)</LI-CODE><P>&nbsp;</P> Sat, 05 Dec 2020 01:19:00 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-split-delimit-and-select-only-certain-value/m-p/532088#M150312 richgalloway 2020-12-05T01:19:00Z https://community.splunk.com/t5/Splunk-Search/How-can-I-split-delimit-and-select-only-certain-value/m-p/532323#M150376 <P><SPAN><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;That worked!. Thank you. Upvoted.</SPAN></P> Tue, 08 Dec 2020 12:18:17 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-split-delimit-and-select-only-certain-value/m-p/532323#M150376 satheeshkumar55 2020-12-08T12:18:17Z