Splunk Search

user fields contains comma in value. Best way to have field value include first and last name?

ericrobinson
Path Finder

My field in the events is as follows

UserFullName=Lastname, Firstname ,

I know that I can use a regex to extract the fields and concantenante the fields using eval to create a new fullname field. That just seems a long way around.

Thanks.

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The best way would be to have the value enclosed in double quotes in the event like this:

UserFullName="Lastname, Firstname I."

Then Splunk will automatically extract the full value into the field.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What you do in rex can be moved to the field extraction configuration.

What do you need eval for?

0 Karma

ericrobinson
Path Finder

I realize fixing the event logging is best, but that is something that takes time and a backlog item with development. I was looking for something with sed etc.. to extract and re-order fields. I am now using rex and eval, but as I stated earlier that seems the long way around.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...