Splunk Search

Extraction of a substring and comparison in a loop

diliptmonson
Explorer

Hi,

I need to search for an element A present in one of the fields let's say field 1.

Some of the values present for field1 in various rows are
Row1: field1=C,D
Row2: field1=E,F,A, ....

I need to do a extract each of the elements present before the comma (,) and compare to see if its A across rows.

Is there a way in Splunk to perform this capability?

Any help in solving this is greatly appreciated.

Cheers,
Dilip

0 Karma
1 Solution

renjith_nair
Legend

Try

   your search  |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO")
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

somesoni2
Revered Legend

Do you need to know when row has field1 with A as one of the value?? IF that's the case, you can try like this

your base search | where isnotnull(mvfind(split(find,","),"A"))
0 Karma

renjith_nair
Legend

Try

   your search  |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO")
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...