How to separate a string which contains multiple value but doesn't have delimiter to separate

Kamal06 — Mon, 06 May 2024 03:06:51 GMT

Hi All,

I want to separate a field which contains multiple value within it but doesn't have delimiter on it.

Example:

| makeresults

| eval field1="example1@splunk.com

example@splunk.com

sample@splunk.com

scheduler"

I have tried to use | eval split = split(field1, " "). But nothing works, Kindly help me out on this like how to separate this single string field as MV field.

Thanks in Advance

Re: How to separate a string which contains multiple value but doesn't have delimiter to separate

bowesmana — Mon, 06 May 2024 03:13:59 GMT

If there is really no delimiter, you can't, but in your case, there is a delimiter, which I am assuming in your example is the line feed at the end of each row. You can either do this by putting a line feed as the split delimiter

| makeresults | eval field1="example1@splunk.com example@splunk.com sample@splunk.com scheduler" | eval x=split(field1, " ") | eval field1_items=mvcount(field1), fieldx_items=mvcount(x)

or you can use replace+split to change the line feed into something easier to split with, e.g.

| eval x=split(replace(field1, "\n", "#!#"), "#!#")

topic Re: How to separate a string which contains multiple value but doesn't have delimiter to separate in Splunk Enterprise

How to separate a string which contains multiple value but doesn't have delimiter to separate

Re: How to separate a string which contains multiple value but doesn't have delimiter to separate