topic Splitting Entries into 2 columns for same field in Splunk Search https://community.splunk.com/t5/Splunk-Search/Splitting-Entries-into-2-columns-for-same-field/m-p/299454#M90246 <P>I need AD auth events and some have multiple entries for Account Name field. One entry is a hyphen (-). Can someone help me build a query to split these into 2 columns, so I can use the entry with the value and not the one with hyphen (-)</P> <P>Subject: <BR /> Security ID: S-1-0-0<BR /> Account Name: -<BR /> Account Domain: - <BR /> Logon ID: 0X0</P> <P>Logon Type: 3</P> <P>Account For which Logon failed:<BR /><BR /> Security ID: S-1-0-0<BR /> Account Name: xyz<BR /> Account Domain: domain.local</P> <P>I need only the Account name information in the event where logon failed. But when I use an eval, am unable to get only 'xyz'</P> <P>Any help is appreciated.</P> <P>R<BR /> Sharad</P> Wed, 15 Feb 2017 05:04:07 GMT sharadkapurala 2017-02-15T05:04:07Z Splitting Entries into 2 columns for same field https://community.splunk.com/t5/Splunk-Search/Splitting-Entries-into-2-columns-for-same-field/m-p/299454#M90246 <P>I need AD auth events and some have multiple entries for Account Name field. One entry is a hyphen (-). Can someone help me build a query to split these into 2 columns, so I can use the entry with the value and not the one with hyphen (-)</P> <P>Subject: <BR /> Security ID: S-1-0-0<BR /> Account Name: -<BR /> Account Domain: - <BR /> Logon ID: 0X0</P> <P>Logon Type: 3</P> <P>Account For which Logon failed:<BR /><BR /> Security ID: S-1-0-0<BR /> Account Name: xyz<BR /> Account Domain: domain.local</P> <P>I need only the Account name information in the event where logon failed. But when I use an eval, am unable to get only 'xyz'</P> <P>Any help is appreciated.</P> <P>R<BR /> Sharad</P> Wed, 15 Feb 2017 05:04:07 GMT https://community.splunk.com/t5/Splunk-Search/Splitting-Entries-into-2-columns-for-same-field/m-p/299454#M90246 sharadkapurala 2017-02-15T05:04:07Z Re: Splitting Entries into 2 columns for same field https://community.splunk.com/t5/Splunk-Search/Splitting-Entries-into-2-columns-for-same-field/m-p/299455#M90247 <P>Is this data of ONE SINGLE EVENT? I mean, you have one event with two Account Name ?</P> Wed, 15 Feb 2017 11:56:53 GMT https://community.splunk.com/t5/Splunk-Search/Splitting-Entries-into-2-columns-for-same-field/m-p/299455#M90247 TiagoTLD1 2017-02-15T11:56:53Z