How can I split values based on two possible delimiters?

[smhsplunk]

    | eval field2=mvindex(split(word, " "),2) 

How can I split based on either space " " or comma ","
Beforehand, I do not know which delimiter will be there, so I want to use both.

[lakromani]

This is how I wold do it. You take the field where you have the word and then split it inn to two new field.

your search | rex field=word "(?<field1>\w+)[\s,](?<field2>\w+)"

Then you should have first part in field1 and second part in field2

[niketn · Accepted solution]

You can try replace command on one of the delimiter fields and replace with other delimiter (in following case comma replaced with space) and then use single delimiter for split(in this case only delimiter will be space:

your base search | eval word=replace(word,","," ") | eval field2=mvindex(split(word, " "),2)

[smhsplunk]

how can I skip a space (if field2 is empty) and chose the next character , would I have to use if statement ?

[niketn]

Can you give example of that word? If condition can definitely be used.

[somesoni2]

You can use makemv command with tokenizer option to achieve the same. Try something like this

your current search | eval field2=word | makemv tokenizer="(\w+)" field2

OR

your current search | eval field2=word | makemv tokenizer="([^\s,]+)" field2

[Yepeza]

Creative solution to make your search a lot less cluttered.

[gokadroid]

Why don't you rex the space into a comma first and then split on comma only:

your base query to give you word
| rex mode=sed field=word "s/\ /,/g"
| split now on comma here