Splitting a multivalue field on carreige return

jeffsegal — Thu, 24 May 2018 14:34:40 GMT

good morning,
I am in the process of breaking out data from a data source that in one field contains a list of similar data for a single device (example below).

example:
(app | version\napp |version\n....)

I have been trying to use a split command using \n as the delimiter and that seems to be working, but when I try to expand the events, only a fraction of the events return. I have included a sample of the code i've been using for your review.

.....|eval new=split(_raw,"\n") |mvexpand new

This seems pretty straight forward, but it doesn't throw an error and it does bring back data, but a small fraction of the what the total should be.

Any suggestions would be greatly appreciated?

Re: Splitting a multivalue field on carreige return

somesoni2 — Thu, 24 May 2018 16:28:35 GMT

Try like this

....| eval new=_raw | eval new=split(new,"\\n") |mvexpand new

OR (if above doesn't work)

--- | eval new=replace(_raw,"[\r\n]+","##LBreak##") | makemv new delim="##LBreak##" | mvexpand new

topic Splitting a multivalue field on carreige return in Splunk Search

Splitting a multivalue field on carreige return

Re: Splitting a multivalue field on carreige return