Solved: Remove extra fields - Splunk Community

Splunk Search

I search the syntax and find Account_Domain result contains two column. How can I result first column so that I left ALPHA??

ALPHA

1 Solution

Solution

| eval Account_Domain=mvindex( Account_Domain,0)

Use this one it will take the 1st column.

View solution in original post

Solution

| eval Account_Domain=mvindex( Account_Domain,0)

Use this one it will take the 1st column.

Thanks it works

You are welcome. Happy Splunking !!!

Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...