Splunk Enterprise

help with EVAL command

shreyasamin64
Explorer

| eval new_name=mvindex(split(name, ","),0),         first name 0 and last name 1

split first and last name

why split and 0&1 used in the pipeline

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

split creates a multi-value field, mvindex returns one of the values referenced by the index, 0 in this instance, which is the first value.

View solution in original post

0 Karma

shreyasamin64
Explorer

yes we use "," in some data's 

thank you @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

split creates a multi-value field, mvindex returns one of the values referenced by the index, 0 in this instance, which is the first value.

0 Karma

shreyasamin64
Explorer

@ITWhisperer  thank you 👍  

why do we use  ","   

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The use of "," was your suggestion. I assume your data has name comma separated, e.g. "John,Smith". If the name is delimited with a different character, you need to change the split command accordingly.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...