How to add a new field to Extracted Field

[aditsss]

Hi Everyone,

I have raw logs in this format:

101107134,2105180551,210518,101107236,gcp_salesforce_user_default_opportunity,cstonedb3,0,E3

101107133,2105180545,210518,101107236,gcp_salesforce_user_role,cstonedb3,50,E3

I have extracted the field with the below query

index=abc source="/splunkLogs/JOB_MDJX_CS_EXTR_STATS_PLATINUM.csv"| append [search source="/splunkLogs/JOB_MDJX_CS_EXTR_STATS_GOLD.csv"]
|append [search source="/splunkLogs/JOB_MDJX_CS_EXTR_STATS_SILVER.csv"]| eval fields=split(_raw,",") |eval Environment=mvindex(fields,7)|eval RunDate=mvindex(fields,2)|eval JOBFLOW_ID=mvindex(fields,0) |eval SRC_NM=mvindex(fields,4)|eval REC_COUNT=mvindex(fields,6)|search REC_COUNT!="REC_COUNT" |where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval Run_Date=strptime(RunDate,"%Y%m%d")|table Run_Date

The one highlighted in bold is rundate. I need to add 20 in front of this to make it 20210518.

Can someone guide me how can I achieve that in my query.

[ITWhisperer · Accepted solution]

| eval RunDate="20".mvindex(fields,2)