Splunk Search
Highlighted

user fields contains comma in value. Best way to have field value include first and last name?

Path Finder

My field in the events is as follows

UserFullName=Lastname, Firstname ,

I know that I can use a regex to extract the fields and concantenante the fields using eval to create a new fullname field. That just seems a long way around.

Thanks.

Tags (2)
0 Karma
Highlighted

Re: user fields contains comma in value. Best way to have field value include first and last name?

SplunkTrust
SplunkTrust

The best way would be to have the value enclosed in double quotes in the event like this:

UserFullName="Lastname, Firstname I."

Then Splunk will automatically extract the full value into the field.

0 Karma
Highlighted

Re: user fields contains comma in value. Best way to have field value include first and last name?

Path Finder

I realize fixing the event logging is best, but that is something that takes time and a backlog item with development. I was looking for something with sed etc.. to extract and re-order fields. I am now using rex and eval, but as I stated earlier that seems the long way around.

0 Karma
Highlighted

Re: user fields contains comma in value. Best way to have field value include first and last name?

SplunkTrust
SplunkTrust

What you do in rex can be moved to the field extraction configuration.

What do you need eval for?

0 Karma