Hi Team,
I have a index below and i want to split the index values and create a new field with it.
Example
index=app-production
index=app-sit
index=app-uat.... etc.
i want to create a new filed as "Environment" and add the splitted values to it such as
Environment field should have "production, sit, uat, .." values
@Allampally
Can you please try this?
YOUR_SEARCH | eval Environment=mvindex(split(index,"-"),1)
Sample search:
| makeresults | eval index="app-production" | eval Environment=mvindex(split(index,"-"),1)
Hi @Allampally,
Both solutions here from @kamlesh_vaghela and @koshyk will do what you're looking for. If you need a more permanent solution please add the following to your sourcetype in props.conf
:
[yoursourcetype]
EVAL-Environment=mvindex(split(index,"-"),1)
This will always include the Environment search in all your queries without having to append anything to your search.
Cheers,
David
alternatively you could use rex command too
| makeresults | eval index="app-production" | rex field=index "\w+\-(?<Environment>\w+)"
cheers
@Allampally
Can you please try this?
YOUR_SEARCH | eval Environment=mvindex(split(index,"-"),1)
Sample search:
| makeresults | eval index="app-production" | eval Environment=mvindex(split(index,"-"),1)