https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304521#M175506 <P>The <CODE>substr</CODE> method returns a new field with the first character of the OrgCode field. What I need is a field for DeptL where only the OrgCodes that start with L are in it. Then a DeptK field with only the OrgCodes that start with K are in it, and so on. This seems logical to me but doesn't work:</P> <PRE><CODE> eval DeptA=[search OrgCode=A*] </CODE></PRE> Wed, 15 Feb 2017 17:28:11 GMT nburgess1 2017-02-15T17:28:11Z https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304518#M175503 <P>Hi,</P> <P>I have a field called "OrgCode" with data like "L6" "L9" "G6" "K6" "K4", which is departments L G and K. I need to get a new field for each department. </P> <P>Thanks</P> Wed, 15 Feb 2017 14:27:50 GMT https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304518#M175503 nburgess1 2017-02-15T14:27:50Z https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304519#M175504 <P>Try this</P> <PRE><CODE>your current search which include field OrgCode | eval Deparment=replace(OrgCode,"^([A-z]+)\d+","\1") </CODE></PRE> Wed, 15 Feb 2017 16:45:14 GMT https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304519#M175504 somesoni2 2017-02-15T16:45:14Z https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304520#M175505 <P>Assuming the department code is always the first character of OrgCode, one of these should do the job.</P> <PRE><CODE>... | rex field=OrgCode "(?&lt;dept&gt;\w)" | ... ... | eval dept = substr(OrgCode, 1, 1) | ... </CODE></PRE> Wed, 15 Feb 2017 16:48:59 GMT https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304520#M175505 richgalloway 2017-02-15T16:48:59Z https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304521#M175506 <P>The <CODE>substr</CODE> method returns a new field with the first character of the OrgCode field. What I need is a field for DeptL where only the OrgCodes that start with L are in it. Then a DeptK field with only the OrgCodes that start with K are in it, and so on. This seems logical to me but doesn't work:</P> <PRE><CODE> eval DeptA=[search OrgCode=A*] </CODE></PRE> Wed, 15 Feb 2017 17:28:11 GMT https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304521#M175506 nburgess1 2017-02-15T17:28:11Z https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304522#M175507 <P>After the field Department/dept is created, you will be able to filter records for a single department. </P> Wed, 15 Feb 2017 17:33:04 GMT https://community.splunk.com/t5/Splunk-Search/New-field-from-search-results/m-p/304522#M175507 somesoni2 2017-02-15T17:33:04Z