Splunk Search

How to modify my search to check mvindex count before eval?

splunker1981
Path Finder

Hello Splunkers,

I'm trying to figure out how to apply an if statement to check the count of an index before adding a value to it. For example, the code below does partially what I need but in cases where split is indexing more than 2 values, that's where I run into issues.

| eval accountInfo=split(content,"/"), user=mvindex(accountname,0), domain=mvindex(accountname,-1)

What I'd like to do is something like;
index=0 will always be correct
index=1 will change depending on items in the index - if there's 3 items based on the split, item 2 will be domain and item 3 will be record
index=2 will be record if there's more than 2 items that were split

Example of what I am looking to eval after splitting
userA/domainB/recordZZ ===> user=userA domain=domainB record=recordZZ
userA/recordC ===> user=userA domain= record=recordC

Tags (3)
0 Karma
1 Solution

niketn
Legend

@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults till | mvexpand accountname generate the dummy data.

| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults till | mvexpand accountname generate the dummy data.

| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Give this a try

.. | rex field=content "^(?<user>[^\/]+)(\/*(?<domain>[^\/]*))\/(?<record>.+)"
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...