split the filed with a hyphen "-" separator

[Allampally]

Hi Team,

I have a index below and i want to split the index values and create a new field with it.
Example
index=app-production
index=app-sit
index=app-uat.... etc.
i want to create a new filed as "Environment" and add the splitted values to it such as
Environment field should have "production, sit, uat, .." values

[DavidHourani]

Hi @Allampally,

Both solutions here from @kamlesh_vaghela and @koshyk will do what you're looking for. If you need a more permanent solution please add the following to your sourcetype in props.conf:

[yoursourcetype]
EVAL-Environment=mvindex(split(index,"-"),1)

This will always include the Environment search in all your queries without having to append anything to your search.

Cheers,
David

[koshyk]

alternatively you could use rex command too

 | makeresults | eval index="app-production" | rex field=index "\w+\-(?<Environment>\w+)"

cheers

[kamlesh_vaghela · Accepted solution]

@Allampally

Can you please try this?

YOUR_SEARCH | eval Environment=mvindex(split(index,"-"),1)

Sample search:

| makeresults | eval index="app-production" | eval Environment=mvindex(split(index,"-"),1)