Splunk Search

Extraction of a substring and comparison in a loop

diliptmonson
Explorer

Hi,

I need to search for an element A present in one of the fields let's say field 1.

Some of the values present for field1 in various rows are
Row1: field1=C,D
Row2: field1=E,F,A, ....

I need to do a extract each of the elements present before the comma (,) and compare to see if its A across rows.

Is there a way in Splunk to perform this capability?

Any help in solving this is greatly appreciated.

Cheers,
Dilip

0 Karma
1 Solution

renjith_nair
Legend

Try

   your search  |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO")
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:

View solution in original post

somesoni2
Revered Legend

Do you need to know when row has field1 with A as one of the value?? IF that's the case, you can try like this

your base search | where isnotnull(mvfind(split(find,","),"A"))
0 Karma

renjith_nair
Legend

Try

   your search  |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO")
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...