Splunk Search

How to extract a specific field (number "n") from an event

leifab
New Member

How to extract a specific field from an event, like "awk '{print $13}'", In this example I want to extract field 13 (22.4):

12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 22.4 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01

0 Karma
1 Solution

jpolvino
Builder

Here is one way to do it, using a Run Anywhere search:

| makeresults
| eval yourEvent="12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 22.4 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01"
| eval fields=split(yourEvent," ") | eval num=mvindex(fields,12)

num=22.4

View solution in original post

jpolvino
Builder

Here is one way to do it, using a Run Anywhere search:

| makeresults
| eval yourEvent="12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 22.4 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01"
| eval fields=split(yourEvent," ") | eval num=mvindex(fields,12)

num=22.4

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...