| eval new_name=mvindex(split(name, ","),0), first name 0 and last name 1
split first and last name
why split and 0&1 used in the pipeline
split creates a multi-value field, mvindex returns one of the values referenced by the index, 0 in this instance, which is the first value.
yes we use "," in some data's
thank you @ITWhisperer
split creates a multi-value field, mvindex returns one of the values referenced by the index, 0 in this instance, which is the first value.
@ITWhisperer thank you 👍
why do we use ","
The use of "," was your suggestion. I assume your data has name comma separated, e.g. "John,Smith". If the name is delimited with a different character, you need to change the split command accordingly.