How to Extract The Initials of a Name Using SPLUNK

Lets say we have a field called Name. We want to extract  the initials of the Name field . Below we have given an example.

Name Desired
Abhay Vikram Singh A.V.Singh
Devang Pandey D.Pandey
Kala Kala
Sumit Chandra Bose S.C.Bose

It can be done very easily by the following query.


index=empdetail sourcetype=csv 
| table Name 
| sort Name 
| eval Asplit=split(Name," ")
| eval MVCount=mvcount(Asplit)
| eval FinalName=case(MVCount=3,substr((mvindex(Asplit,0)),1,1)."."
| fields Name,FinalName





In the above query “empdetail” is the index name and “csv” is the sourcetype name . “Name” is the existing field name in this index.

By the “split” function we have splitted the “Name” field then by the “mvcount” function we have counted the words of each of the name. Then we have used the “case” function with the “eval” command if word count of the Name(s) are 3 then it will take initials of the first 2 words and will append before the 3rd word separated by “.”. If word count of the Name(s) are 2 then it will take initial of the  1st  word and will append before the 2nd   word separated by “.”. If the word count of Name(s) are 1 then it will show as it is. At last by the “fields” command we have taken the “Name” and desired output result field as “FinalName”.


Hope this has helped you in achieving the below requirement without fail :

How to Extract The Initals of a Name Using SPLUNK

Happy Splunking !!