Splunk Search

How to modify my search to check mvindex count before eval?

Path Finder

Hello Splunkers,

I'm trying to figure out how to apply an if statement to check the count of an index before adding a value to it. For example, the code below does partially what I need but in cases where split is indexing more than 2 values, that's where I run into issues.

| eval accountInfo=split(content,"/"), user=mvindex(accountname,0), domain=mvindex(accountname,-1)

What I'd like to do is something like;
index=0 will always be correct
index=1 will change depending on items in the index - if there's 3 items based on the split, item 2 will be domain and item 3 will be record
index=2 will be record if there's more than 2 items that were split

Example of what I am looking to eval after splitting
userA/domainB/recordZZ ===> user=userA domain=domainB record=recordZZ
userA/recordC ===> user=userA domain= record=recordC

Tags (3)
0 Karma
1 Solution

Legend

@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults till | mvexpand accountname generate the dummy data.

| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Legend

@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults till | mvexpand accountname generate the dummy data.

| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Revered Legend

Give this a try

.. | rex field=content "^(?<user>[^\/]+)(\/*(?<domain>[^\/]*))\/(?<record>.+)"
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!