Getting Data In

Splunk Lastname firstname formating

arunsundarm
Engager

I am using this query to fetch current logged in user "|rest splunk_server=local /services/authentication/current-context | fields realname"
It displays real name as Lastname, Firstname
Now i want a nother field with value "Firstname Lastname" format

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try rex.

... | eval name=realname | rex field=name mode=sed "s/([^,]+), (.*)/\2 \1/"
---
If this reply helps you, an upvote would be appreciated.

Nextbeat
Path Finder

Thanks for reminding me that Sed can do this, but was originally curious about the eval way.

0 Karma

to4kawa
SplunkTrust
SplunkTrust
... | eval name=mvindex(split(realname,","),1).",".mvindex(split(realname,","),0)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!