Solved: Re: Remove extra fields - Splunk Community

Splunk Search

I search the syntax and find Account_Domain result contains two column. How can I result first column so that I left ALPHA??

ALPHA

1 Solution

Solution

| eval Account_Domain=mvindex( Account_Domain,0)

Use this one it will take the 1st column.

View solution in original post

Solution

| eval Account_Domain=mvindex( Account_Domain,0)

Use this one it will take the 1st column.

Thanks it works

You are welcome. Happy Splunking !!!

Get Updates on the Splunk Community!

Deep Dive: The Agentic SOC in Action with Enterprise Security Agents

Takeaways: Splunk Enterprise Security brings Agentic SOC capabilities into the analyst workflow. Agents ...

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...