topic Re: How to split single line field value into multiple lines using regex? in Getting Data In

How to split single line field value into multiple lines using regex?

pavanae — Wed, 06 Apr 2022 22:54:39 GMT

I have a field value in splunk with the below format :-

field_X = "AB 012 - some text here! ---- HOST INFORMATION: ---- Source: 1.1.2.3 ---- DETAILS: -- Destination ports: 777 33 -- Occurrences: 2244 -- Destination ip counts: 146 -- Actions: blocked -- Order Techniques : X3465 "

Now How can I split the abpve field value into multiple lines to make it more user redable using eval and regex

field_X = AB 012 - some text here! HOST INFORMATION: Source: 1.1.2.3 DETAILS: Destination ports: 777 33 Occurrences: 2244 Destination ip counts: 146 Actions: blocked Order Techniques : X3465

All I wanted is replace "--" with a line space or something to divide the field into multiple lines from 1 line?

Re: How to split single line field value into multiple lines using regex?

bowesmana — Wed, 06 Apr 2022 23:00:39 GMT

See this example

| makeresults | eval field_X = "AB 012 - some text here! ---- HOST INFORMATION: ---- Source: 1.1.2.3 ---- DETAILS: -- Destination ports: 777 33 -- Occurrences: 2244 -- Destination ip counts: 146 -- Actions: blocked -- Order Techniques : X3465 " | makemv delim="--" field_X | eval field_X=trim(field_X)

Re: How to split single line field value into multiple lines using regex?

bowesmana — Wed, 06 Apr 2022 23:01:30 GMT

Note that field_X will then be a multi-value field with 9 values