https://community.splunk.com/t5/Getting-Data-In/Splitting-a-fields-values-into-a-seperate-field-by-a-third-field/m-p/518758#M87692 <P>Nothing distinctive to pin point which is which.&nbsp; We could add the Ampid field and go by the lowest number as the ingress and then the highest number as egress.&nbsp;&nbsp;</P><P>TID&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PORTAID&nbsp; &nbsp;AMPID&nbsp; &nbsp; &nbsp; OMSID</P><TABLE><TBODY><TR><TD>COLNNYEJWP001</TD><TD>1/13</TD><TD>3160113</TD><TD>oms-100486</TD></TR><TR><TD>TROYNYDWWP001</TD><TD>1/6</TD><TD>3380106</TD><TD>oms-100486</TD></TR></TBODY></TABLE> Wed, 09 Sep 2020 19:18:27 GMT vanceinc 2020-09-09T19:18:27Z https://community.splunk.com/t5/Getting-Data-In/Splitting-a-fields-values-into-a-seperate-field-by-a-third-field/m-p/518753#M87690 <P>I want to be able to split the TID field into two new fields (Ingress_TID and Egress_TID) by correlating against the OMS_ID which is the same ID number for both.&nbsp;&nbsp;<BR /><BR /></P><P>Example data:</P><P>&nbsp;</P><P>TID&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PORTAID&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OMSID</P><TABLE><TBODY><TR><TD>BLTNMNFSWP001</TD><TD>1/7</TD><TD>oms-100483</TD></TR><TR><TD>MNNTMNICWP001</TD><TD>3/13</TD><TD>oms-100483</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>in the end want it to transform to&nbsp;</P><P>Ingress_TID&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Egress_TID&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PORTAID&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;OMSID<BR />BLTNMNFSWP001&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1/7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;oms-100483</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;MNNTMNICWP001&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;3/13&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;oms-100483<BR /><BR /></P><P>Any help would be great.&nbsp; Thank you!!</P> Wed, 09 Sep 2020 18:52:33 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-a-fields-values-into-a-seperate-field-by-a-third-field/m-p/518753#M87690 vanceinc 2020-09-09T18:52:33Z https://community.splunk.com/t5/Getting-Data-In/Splitting-a-fields-values-into-a-seperate-field-by-a-third-field/m-p/518756#M87691 How you are knowing which event is ingress an$ which egress? Wed, 09 Sep 2020 19:01:00 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-a-fields-values-into-a-seperate-field-by-a-third-field/m-p/518756#M87691 isoutamo 2020-09-09T19:01:00Z https://community.splunk.com/t5/Getting-Data-In/Splitting-a-fields-values-into-a-seperate-field-by-a-third-field/m-p/518758#M87692 <P>Nothing distinctive to pin point which is which.&nbsp; We could add the Ampid field and go by the lowest number as the ingress and then the highest number as egress.&nbsp;&nbsp;</P><P>TID&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PORTAID&nbsp; &nbsp;AMPID&nbsp; &nbsp; &nbsp; OMSID</P><TABLE><TBODY><TR><TD>COLNNYEJWP001</TD><TD>1/13</TD><TD>3160113</TD><TD>oms-100486</TD></TR><TR><TD>TROYNYDWWP001</TD><TD>1/6</TD><TD>3380106</TD><TD>oms-100486</TD></TR></TBODY></TABLE> Wed, 09 Sep 2020 19:18:27 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-a-fields-values-into-a-seperate-field-by-a-third-field/m-p/518758#M87692 vanceinc 2020-09-09T19:18:27Z