Splunk Search

Extraction of a substring and comparison in a loop

diliptmonson
Explorer

Hi,

I need to search for an element A present in one of the fields let's say field 1.

Some of the values present for field1 in various rows are
Row1: field1=C,D
Row2: field1=E,F,A, ....

I need to do a extract each of the elements present before the comma (,) and compare to see if its A across rows.

Is there a way in Splunk to perform this capability?

Any help in solving this is greatly appreciated.

Cheers,
Dilip

0 Karma
1 Solution

renjith_nair
Legend

Try

   your search  |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO")
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

somesoni2
Revered Legend

Do you need to know when row has field1 with A as one of the value?? IF that's the case, you can try like this

your base search | where isnotnull(mvfind(split(find,","),"A"))
0 Karma

renjith_nair
Legend

Try

   your search  |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO")
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...