Solved: Re: Remove extra fields - Splunk Community

Splunk Search

I search the syntax and find Account_Domain result contains two column. How can I result first column so that I left ALPHA??

ALPHA

1 Solution

Solution

| eval Account_Domain=mvindex( Account_Domain,0)

Use this one it will take the 1st column.

View solution in original post

Solution

| eval Account_Domain=mvindex( Account_Domain,0)

Use this one it will take the 1st column.

Thanks it works

You are welcome. Happy Splunking !!!

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...