How to Extract The Initials of a Name Using SPLUNK

How to Extract The Initials of a Name Using SPLUNK

Lets say we have a field called Name. We want to extract  the initials of the Name field . Below we have given an example.

It can be done very easily by the following query.

QUERY:

index=empdetail sourcetype=csv 
| table Name 
| sort Name 
| eval Asplit=split(Name," ")
| eval MVCount=mvcount(Asplit)
| eval FinalName=case(MVCount=3,substr((mvindex(Asplit,0)),1,1)."."
.substr((mvindex(Asplit,1)),1,1)."."
.mvindex(Asplit,2),MVCount=2,substr((mvindex(Asplit,0)),1,1)."."
.mvindex(Asplit,1),1=1,Asplit)
| fields Name,FinalName

Result:

Explanation:

In the above query “empdetail” is the index name and “csv” is the sourcetype name . “Name” is the existing field name in this index.

By the “split” function we have splitted the “Name” field then by the “mvcount” function we have counted the words of each of the name. Then we have used the “case” function with the “eval” command if word count of the Name(s) are 3 then it will take initials of the first 2 words and will append before the 3^rd word separated by “.”. If word count of the Name(s) are 2 then it will take initial of the  1^st  word and will append before the 2^nd   word separated by “.”. If the word count of Name(s) are 1 then it will show as it is. At last by the “fields” command we have taken the “Name” and desired output result field as “FinalName”.

Hope this has helped you in achieving the below requirement without fail :

How to Extract The Initals of a Name Using SPLUNK

Happy Splunking !!