topic Re: Splitting raw field after transaction in Splunk Search

Splitting raw field after transaction

moinyuso96 — Thu, 17 Jun 2021 03:39:53 GMT

I used transaction to combine 2 rows of raw fields:

raw

4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345

4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345

4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345

1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890

1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890

Is there a simple way to split the raw field into "raw1" and "raw2" as below (preferably without using rex)?

raw	raw1	raw2
4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345 4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345	4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345	4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345
4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345	4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345
1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890 1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890	1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890	1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890

Re: Splitting raw field after transaction

bowesmana — Thu, 17 Jun 2021 03:45:07 GMT

Using mvindex on the multivalue raw field

| eval raw1=mvindex(raw,0), raw2=mvindex(raw,1)

Re: Splitting raw field after transaction

bowesmana — Thu, 17 Jun 2021 03:50:33 GMT

Also just FYI - as a generic solution to splitting multivalue fields where you don't always know you will have 2 fields, you can do this sort of thing

| foreach 0 1 2 3 4 5 [ eval raw<<FIELD>>=mvindex(raw,<<FIELD>>) ]

which would split up to 6 values of a multi-value field into raw0, raw1, raw2 etc.