How to extract a specific field from an event, like "awk '{print $13}'", In this example I want to extract field 13 (22.4):
12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 22.4 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01
Here is one way to do it, using a Run Anywhere search:
| makeresults
| eval yourEvent="12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 22.4 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01"
| eval fields=split(yourEvent," ") | eval num=mvindex(fields,12)
num=22.4
Here is one way to do it, using a Run Anywhere search:
| makeresults
| eval yourEvent="12345 0.0 0.0 90 -2.3 51 985.7 12.3 12.3 12.3 0.000 0.000 22.4 41 0.0 0 0.0 0 0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 0 20 19 01"
| eval fields=split(yourEvent," ") | eval num=mvindex(fields,12)
num=22.4