Change order of comma separated names

[Kat456]

I have a list of comma separated names (lastname, firstname) that I need to reverse. So "Smith, Suzy" becomes "Suzy Smith".  What's the easiest way to do this? 

[gcusello]

Hi @Kat456 ,

I suppose that you ingested these data from the csv file in Splunk.

When you have them in Splunk you cas have in the order you like:

index=your_index
| table firstname lastname

Ciao.

Giuseppe

[yuanliu]

When you say "a list of", I assume that this list is in a field that is single-valued in each event.  Is this correct?  Assuming yes, and assuming a field name of fullname, you can do

| eval fullname = trim(split(fullname, ","), " ")
| eval fullname = mvjoin(mvreverse(fullname), " ")

Here is an emulation you can run and compare with real data

| makeresults
| fields - _*
| eval fullname = "Smith, Suzy"
``` data emulation above ```
| eval fullname = trim(split(fullname, ","), " ")
| eval fullname = mvjoin(mvreverse(fullname), " ")

Output is

fullname

Suzy Smith

Hope this helps

[Kat456]

This worked perfectly. Thank you!