Why don't you rex the space into a comma first and then split on comma only:
your base query to give you word | rex mode=sed field=word "s/\ /,/g" | split now on comma here
You can use makemv command with tokenizer option to achieve the same. Try something like this
your current search | eval field2=word | makemv tokenizer="(\w+)" field2
your current search | eval field2=word | makemv tokenizer="([^\s,]+)" field2
You can try replace command on one of the delimiter fields and replace with other delimiter (in following case comma replaced with space) and then use single delimiter for split(in this case only delimiter will be space:
your base search | eval word=replace(word,","," ") | eval field2=mvindex(split(word, " "),2)
how can I skip a space (if field2 is empty) and chose the next character , would I have to use if statement ?
Can you give example of that word? If condition can definitely be used.
This is how I wold do it. You take the field where you have the
word and then split it inn to two new field.
your search | rex field=word "(?<field1>\w+)[\s,](?<field2>\w+)"
Then you should have first part in
field1 and second part in