topic Re: Split a single field into two fields in Splunk Search

Split a single field into two fields

Allampally — Fri, 04 May 2018 11:30:55 GMT

Hi,

I have a raw_data as below
[APP=XYZ] [m=ServiceName.MethodName] [SLA=100]
Splunk already generated a filed with the name 'm".
I want to split this field into two separate fields(m1 & m2) as below
m1=ServiceName
m2=MethodName

Could anyone help me to do so ?

Re: Split a single field into two fields

cmerriman — Fri, 04 May 2018 11:34:05 GMT

without knowing what the data actually looks like, you could try this in the search string:

|rex field=m "(?<m1>.*)\.(?<m2>.*)"

if you would like this to be automatically extracted, you could add the extraction if you are an admin. look over this doc:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Managesearch-timefieldextractions

Re: Split a single field into two fields

Allampally — Mon, 07 May 2018 04:32:18 GMT

Thank you cmerriman :). It worked for me