Splunk Enterprise

help with EVAL command

shreyasamin64
Explorer

| eval new_name=mvindex(split(name, ","),0),         first name 0 and last name 1

split first and last name

why split and 0&1 used in the pipeline

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

split creates a multi-value field, mvindex returns one of the values referenced by the index, 0 in this instance, which is the first value.

View solution in original post

0 Karma

shreyasamin64
Explorer

yes we use "," in some data's 

thank you @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

split creates a multi-value field, mvindex returns one of the values referenced by the index, 0 in this instance, which is the first value.

0 Karma

shreyasamin64
Explorer

@ITWhisperer  thank you 👍  

why do we use  ","   

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The use of "," was your suggestion. I assume your data has name comma separated, e.g. "John,Smith". If the name is delimited with a different character, you need to change the split command accordingly.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...