Splunk Search

split the filed with a hyphen "-" separator

Allampally
Path Finder

Hi Team,

I have a index below and i want to split the index values and create a new field with it.
Example
index=app-production
index=app-sit
index=app-uat.... etc.
i want to create a new filed as "Environment" and add the splitted values to it such as
Environment field should have "production, sit, uat, .." values

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Allampally

Can you please try this?

YOUR_SEARCH | eval Environment=mvindex(split(index,"-"),1)

Sample search:

| makeresults | eval index="app-production" | eval Environment=mvindex(split(index,"-"),1)

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @Allampally,

Both solutions here from @kamlesh_vaghela and @koshyk will do what you're looking for. If you need a more permanent solution please add the following to your sourcetype in props.conf:

[yoursourcetype]
EVAL-Environment=mvindex(split(index,"-"),1)

This will always include the Environment search in all your queries without having to append anything to your search.

Cheers,
David

0 Karma

koshyk
Super Champion

alternatively you could use rex command too

 | makeresults | eval index="app-production" | rex field=index "\w+\-(?<Environment>\w+)"

cheers

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Allampally

Can you please try this?

YOUR_SEARCH | eval Environment=mvindex(split(index,"-"),1)

Sample search:

| makeresults | eval index="app-production" | eval Environment=mvindex(split(index,"-"),1)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...