Splunk Search

Extraction of a substring and comparison in a loop

diliptmonson
Explorer

Hi,

I need to search for an element A present in one of the fields let's say field 1.

Some of the values present for field1 in various rows are
Row1: field1=C,D
Row2: field1=E,F,A, ....

I need to do a extract each of the elements present before the comma (,) and compare to see if its A across rows.

Is there a way in Splunk to perform this capability?

Any help in solving this is greatly appreciated.

Cheers,
Dilip

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try

   your search  |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO")
Happy Splunking!

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Do you need to know when row has field1 with A as one of the value?? IF that's the case, you can try like this

your base search | where isnotnull(mvfind(split(find,","),"A"))
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try

   your search  |eval Result=if(mvindex(split(field1,","),0) =="A","YES","NO")
Happy Splunking!
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...