I've the following data in my table part1.part2.answer.local part1-part2..part3.part4.answer.net part11.part11-part11.answerxyz.net part1-part2-part3-part4.answer.net part1-part2-part3-part6.answer.com part127.09 abcd (+789) part127.08 abcd (+123) part127.06 abcd (+456) I want to split it as follows : 1.) If there is a space present in the data then it should be returned exactly as it is input-------------------------------------output part127.09 abcd (+789)-------- part127.09 abcd (+789) part127.08 abcd (+123)------- part127.08 abcd (+123) part127.06 abcd (+456) --------part127.06 abcd (+456) 2.) If there is no space then the part before the first dot should be returned input------------------------------------------------------ output part1.part2.answer.local ----------------------------------part1 part1-part2..part3.part4.answer.net------------------- part1-part2 part11.part11-part11.answerxyz.net ------------------part11 part1-part2-part3-part4.answer.net -------------------part1-part2-part3-part4 part1-part2-part3-part6.answer.com------------------part1-part2-part3-part6 I've tried this :       index=ind sourcetype=src | fields f1 | where f1 != "null" | dedup f1 | eval temp=f1 | eval derived_name_having_space=if(match(f1,"\s*[[:space:]]+"),1,0) | eval with_Space=f1 | where derived_name_having_space=1 | eval without_Space=mvindex(split(temp,"."),0) | where derived_name_having_space=0 | table with_Space without_Space f1       Here I'm not getting any rows returned. -------------------------------------------------------------------------- But , In the above query when I remove the part       | eval without_Space=mvindex(split(temp,"."),0) | where derived_name_having_space=0       I get the correct results of the rows where derived_name_having_space=1 . --------------------------------------------------------------------------- Similarly, when I remove the part       | eval with_Space=f1 | where derived_name_having_space=1       I don't get the correct results of the rows where derived_name_having_space=0 . input ---------------------------------------------output part127.09 abcd (+789)-------------------- -part127 part127.08 abcd (+123) -------------------- part127 part127.06 abcd (+456) -------------------- part127 Since they all evaluate to the same result it creates a problem while deduping. ------------------------------------------------------------------------------- I've used the regex class from here : https://www.debuggex.com/cheatsheet/regex/pcre Can anyone point me where I'm missing it or any other approach should be followed? Thanks ... View more

I'm having 3 indexes A(SUPER-SET),  B(SUBSET-1),  C(SUBSET-2). I'm having 2 radio button groups: Group1 and Group2   Group1 has 2 options: YES and NO When "YES" is selected then it performs A intersection B and "NO" does not perform any search.   Group2 has 2 options: YES and NO When "YES" is selected then it performs A intersection C "NO" does not perform any search.   I'm having the following SOURCE CODE for it :       <input type="radio" token="field1" searchWhenChanged="true"> <label>Present in AB</label> <choice value="Yes">Yes</choice> <choice value="No">No</choice> <change> <condition value="Yes"> <set token="mysearch"> index=a ..................... | join <common_column> type=outer [| search index= B] | where check_column_value="BBBBBBBBBBB" | table <list of columns> </set> </condition> <condition value="No"> <set token="mysearch"></set> </condition> </change> </input> <input type="radio" token="field2" searchWhenChanged="true"> <label>Present in AC</label> <choice value="Yes">Yes</choice> <choice value="No">No</choice> <change> <condition value="Yes"> <set token="mysearch"> index=a ..................... | join <common_column> type=outer [| search index= C] | where check_column_value="CCCCCCCCCCCC" | table <list of columns> </set> </condition> <condition value="No"> <set token="mysearch"></set> </condition> </change> </input> <table> <search> <query>$mysearch$</query> </search> </table>           When i click on YES buttons for the two groups :   When I select both the YES options the result I get is from the index which is last selected as YES option only, i.e. in any case i'm not getting the result from both the sources even after selecting "YES" option. I feel there is some issue with the token value in the last part of the code shared above.(Not sure!!)   Can anyone help me with this please? Thanks ... View more