https://community.splunk.com/t5/Splunk-Search/Extraction-of-a-substring-and-comparison-in-a-loop/m-p/284320#M85960 <P>Hi,</P> <P>I need to search for an element A present in one of the fields let's say field 1.</P> <P>Some of the values present for field1 in various rows are<BR /> Row1: field1=C,D<BR /> Row2: field1=E,F,A, ....</P> <P>I need to do a extract each of the elements present before the comma (,) and compare to see if its A across rows.</P> <P>Is there a way in Splunk to perform this capability?</P> <P>Any help in solving this is greatly appreciated.</P> <P>Cheers,<BR /> Dilip</P> Thu, 18 Feb 2016 02:27:34 GMT diliptmonson 2016-02-18T02:27:34Z https://community.splunk.com/t5/Splunk-Search/Extraction-of-a-substring-and-comparison-in-a-loop/m-p/284320#M85960 <P>Hi,</P> <P>I need to search for an element A present in one of the fields let's say field 1.</P> <P>Some of the values present for field1 in various rows are<BR /> Row1: field1=C,D<BR /> Row2: field1=E,F,A, ....</P> <P>I need to do a extract each of the elements present before the comma (,) and compare to see if its A across rows.</P> <P>Is there a way in Splunk to perform this capability?</P> <P>Any help in solving this is greatly appreciated.</P> <P>Cheers,<BR /> Dilip</P> Thu, 18 Feb 2016 02:27:34 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-of-a-substring-and-comparison-in-a-loop/m-p/284320#M85960 diliptmonson 2016-02-18T02:27:34Z https://community.splunk.com/t5/Splunk-Search/Extraction-of-a-substring-and-comparison-in-a-loop/m-p/284321#M85961 <P>Try</P> <PRE><CODE> your search |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO") </CODE></PRE> Thu, 18 Feb 2016 09:00:24 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-of-a-substring-and-comparison-in-a-loop/m-p/284321#M85961 renjith_nair 2016-02-18T09:00:24Z https://community.splunk.com/t5/Splunk-Search/Extraction-of-a-substring-and-comparison-in-a-loop/m-p/284322#M85962 <P>Do you need to know when row has field1 with A as one of the value?? IF that's the case, you can try like this</P> <PRE><CODE>your base search | where isnotnull(mvfind(split(find,","),"A")) </CODE></PRE> Thu, 18 Feb 2016 17:31:36 GMT https://community.splunk.com/t5/Splunk-Search/Extraction-of-a-substring-and-comparison-in-a-loop/m-p/284322#M85962 somesoni2 2016-02-18T17:31:36Z