How to Extract The Initials of a Name Using SPLUNK
Lets say we have a field called Name. We want to extract the initials of the Name field . Below we have given an example.
|Abhay Vikram Singh||A.V.Singh|
|Sumit Chandra Bose||S.C.Bose|
It can be done very easily by the following query.
index=empdetail sourcetype=csv | table Name | sort Name | eval Asplit=split(Name," ") | eval MVCount=mvcount(Asplit) | eval FinalName=case(MVCount=3,substr((mvindex(Asplit,0)),1,1)."." .substr((mvindex(Asplit,1)),1,1)."." .mvindex(Asplit,2),MVCount=2,substr((mvindex(Asplit,0)),1,1)."." .mvindex(Asplit,1),1=1,Asplit) | fields Name,FinalName
In the above query “empdetail” is the index name and “csv” is the sourcetype name . “Name” is the existing field name in this index.
By the “split” function we have splitted the “Name” field then by the “mvcount” function we have counted the words of each of the name. Then we have used the “case” function with the “eval” command if word count of the Name(s) are 3 then it will take initials of the first 2 words and will append before the 3rd word separated by “.”. If word count of the Name(s) are 2 then it will take initial of the 1st word and will append before the 2nd word separated by “.”. If the word count of Name(s) are 1 then it will show as it is. At last by the “fields” command we have taken the “Name” and desired output result field as “FinalName”.
Hope this has helped you in achieving the below requirement without fail :
How to Extract The Initals of a Name Using SPLUNK
Happy Splunking !!