Splunk Search

How to modify my search to check mvindex count before eval?

splunker1981
Path Finder

Hello Splunkers,

I'm trying to figure out how to apply an if statement to check the count of an index before adding a value to it. For example, the code below does partially what I need but in cases where split is indexing more than 2 values, that's where I run into issues.

| eval accountInfo=split(content,"/"), user=mvindex(accountname,0), domain=mvindex(accountname,-1)

What I'd like to do is something like;
index=0 will always be correct
index=1 will change depending on items in the index - if there's 3 items based on the split, item 2 will be domain and item 3 will be record
index=2 will be record if there's more than 2 items that were split

Example of what I am looking to eval after splitting
userA/domainB/recordZZ ===> user=userA domain=domainB record=recordZZ
userA/recordC ===> user=userA domain= record=recordC

Tags (3)
0 Karma
1 Solution

niketnilay
Legend

@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults till | mvexpand accountname generate the dummy data.

| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketnilay
Legend

@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults till | mvexpand accountname generate the dummy data.

| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

.. | rex field=content "^(?<user>[^\/]+)(\/*(?<domain>[^\/]*))\/(?<record>.+)"
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!