Getting Data In

Splunk Lastname firstname formating

arunsundarm
Engager

I am using this query to fetch current logged in user "|rest splunk_server=local /services/authentication/current-context | fields realname"
It displays real name as Lastname, Firstname
Now i want a nother field with value "Firstname Lastname" format

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try rex.

... | eval name=realname | rex field=name mode=sed "s/([^,]+), (.*)/\2 \1/"
---
If this reply helps you, Karma would be appreciated.

Nextbeat
Path Finder

Thanks for reminding me that Sed can do this, but was originally curious about the eval way.

0 Karma

to4kawa
Ultra Champion
... | eval name=mvindex(split(realname,","),1).",".mvindex(split(realname,","),0)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...