How to modify my search to check mvindex count before eval?

[splunker1981]

Hello Splunkers,

I'm trying to figure out how to apply an if statement to check the count of an index before adding a value to it. For example, the code below does partially what I need but in cases where split is indexing more than 2 values, that's where I run into issues.

| eval accountInfo=split(content,"/"), user=mvindex(accountname,0), domain=mvindex(accountname,-1)

What I'd like to do is something like;
index=0 will always be correct
index=1 will change depending on items in the index - if there's 3 items based on the split, item 2 will be domain and item 3 will be record
index=2 will be record if there's more than 2 items that were split

Example of what I am looking to eval after splitting
userA/domainB/recordZZ ===> user=userA domain=domainB record=recordZZ
userA/recordC ===> user=userA domain= record=recordC

[niketn · Accepted solution]

@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults till | mvexpand accountname generate the dummy data.

| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))

[somesoni2]

Give this a try

.. | rex field=content "^(?<user>[^\/]+)(\/*(?<domain>[^\/]*))\/(?<record>.+)"