How to split a single line which contains multiple field values separated by spaces into multiple fields in Splunk?

pavanae — Fri, 03 Sep 2021 02:14:11 GMT

I have a csv file query as follows :-

| inputlookup file_1.csv

which gives the result as follows in a single line as a single field or column

A B C D E F G H

i j k l m n o p

q r s t u v w x

Now, I want to turn the above result as follows with multiple fields naming A, B,C,D,E,F,G,H basically what I am trying to acheive is convert the single field into multiple fields with each field name or field value is extracted based on a space separation in the single field from above?

A	B	C	D	E	F	G	H
i	j	k	l	m	n	o	p
q	r	s	t	u	v	w	x

Re: How to split a single line which contains multiple field values separated by spaces into multiple fields in Splunk?

richgalloway — Fri, 03 Sep 2021 11:21:30 GMT

rex can do that for you.

| rex "(?<A>\S+)\s(?<A>\S+)\s(?<B>\S+)\s(?<C>\S+)\s(?<E>\S+)\s(?<F>\S+)\s(?<G>\S+)\s(?<H>\S+)\s"

It would be better if you could have the CSV file created as a true comma-separated value file. Then Splunk would separate the fields automatically.

topic How to split a single line which contains multiple field values separated by spaces into multiple fields in Splunk? in Splunk Search

How to split a single line which contains multiple field values separated by spaces into multiple fields in Splunk?

Re: How to split a single line which contains multiple field values separated by spaces into multiple fields in Splunk?