Hello Splunkers,
I'm trying to figure out how to apply an if statement to check the count of an index before adding a value to it. For example, the code below does partially what I need but in cases where split is indexing more than 2 values, that's where I run into issues.
| eval accountInfo=split(content,"/"), user=mvindex(accountname,0), domain=mvindex(accountname,-1)
What I'd like to do is something like;
index=0 will always be correct
index=1 will change depending on items in the index - if there's 3 items based on the split, item 2 will be domain and item 3 will be record
index=2 will be record if there's more than 2 items that were split
Example of what I am looking to eval after splitting
userA/domainB/recordZZ ===> user=userA domain=domainB record=recordZZ
userA/recordC ===> user=userA domain= record=recordC
@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults
till | mvexpand accountname
generate the dummy data.
| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))
@splunker1981 following is a run anywhere search based on sample data provided.
PS: query from | makeresults
till | mvexpand accountname
generate the dummy data.
| makeresults
| eval accountname="userA/domainB/recordZZ;userA/recordC"
| makemv accountname delim=";"
| mvexpand accountname
| makemv accountname delim="/"
| eval user=mvindex(accountname,0), domain=case(mvcount(accountname)=3,mvindex(accountname,1)), record=case(mvcount(accountname)=2,mvindex(accountname,1),mvcount(accountname)=3,mvindex(accountname,2))
Give this a try
.. | rex field=content "^(?<user>[^\/]+)(\/*(?<domain>[^\/]*))\/(?<record>.+)"