topic Re: how to reverse field value in Splunk in Splunk Search

how to reverse field value in Splunk

joomla — Fri, 07 Jul 2023 11:28:34 GMT

Hi Team,

I have a field name domain with value "www.microsoft.com"; how I can reverse that and make it to "com.microsoft.www"

domain=www.microsoft.com

required: domain=com.microsoft.www

Many Thanks.

Re: how to reverse field value in Splunk

ITWhisperer — Fri, 07 Jul 2023 12:49:23 GMT

| eval _domain=split(domain,".") | foreach mode=multivalue _domain [| eval dom=if(isnull(dom),<<ITEM>>,<<ITEM>>.".".dom)]

Re: how to reverse field value in Splunk

gcusello — Fri, 07 Jul 2023 12:58:51 GMT

Hi @joomla,

if the structure is fixed, you can use a regex, otherwise I suppose that it isn't possible:

<your_search> | rex field=domain "^(?<part1>[^\.]+)\.^(?<part2>[^\.]+)\.^(?<part3>[^\.]+)" | eval new_domain=part3.".".part2.".".part1 | table domain new_domain

Ciao.

Giuseppe

Re: how to reverse field value in Splunk

richgalloway — Fri, 07 Jul 2023 13:02:44 GMT

This is a new one to me. If the domain is always 3 parts you can split the domain then use foreach to put the pieces back together in reverse order as in this run-anywhere example.

| makeresults | eval domain="www.microsoft.com" ``` Above just creates demo data ``` ``` Break the domain at each dot ``` | eval foo=split(domain,".") ``` Iterate over the segments in reverse order and put them together ``` | foreach 2 1 0 [ eval rev_domain=mvjoin(mvappend(rev_domain,mvindex(foo,<<FIELD>>)),".")] | table domain rev_domain