topic Reduce the EVAL command SPL in Splunk Search

topic Reduce the EVAL command SPL in Splunk Search https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577288#M201181 <P>could someone who is SPL expert help me reduce this:</P><P> </P><P> </P><LI-CODE lang="markup">|eval dest=replace(dest, "dstdomain|src|any-of|dst|# ", ""), dest=replace(mvjoin(dest, " "), "/32", "|"), dest=split(dest, "|"), dest=split(dest, " ") </LI-CODE><P> </P><P> </P> Fri, 03 Dec 2021 22:11:35 GMT youngsuh 2021-12-03T22:11:35Z Reduce the EVAL command SPL https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577288#M201181 <P>could someone who is SPL expert help me reduce this:</P><P> </P><P> </P><LI-CODE lang="markup">|eval dest=replace(dest, "dstdomain|src|any-of|dst|# ", ""), dest=replace(mvjoin(dest, " "), "/32", "|"), dest=split(dest, "|"), dest=split(dest, " ") </LI-CODE><P> </P><P> </P> Fri, 03 Dec 2021 22:11:35 GMT https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577288#M201181 youngsuh 2021-12-03T22:11:35Z Re: Reduce the EVAL command SPL https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577289#M201182 <P>Can you share some sample events that you are trying to  process?</P> Fri, 03 Dec 2021 22:16:47 GMT https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577289#M201182 ITWhisperer 2021-12-03T22:16:47Z Re: Reduce the EVAL command SPL https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577290#M201183 <P>What is the problem you are trying to solve?</P> Fri, 03 Dec 2021 22:17:28 GMT https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577290#M201183 richgalloway 2021-12-03T22:17:28Z Re: Reduce the EVAL command SPL https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577293#M201186 <P>I am trying to parse the squid.conf file into a table.  I can't actually post the conf file due to security reason.</P><LI-CODE lang="markup">sourcetype="conf_no_timestamp" | rex "( P<rule_name>^http_access|acl|cache|always_direct|persistent_request_timeout|request_timeout|follow_x_forwarded_for)\s(?P<action>[\w]+)\s(?<server_group_name>.*)$" | eval action=split(action," ") | eval server_group_name=split(server_group_name, " ") | where action like "allow" | table rule_name, server_group_name, action | append [ search sourcetype="conf_no_timestamp" | rex "(?P<rule_name>^http_access|acl|cache|always_direct|persistent_request_timeout|request_timeout|follow_x_forwarded_for)\s(?P<server_group_name>[\w]+)\s(?<dest>.*)$" | eval server_group_name=split(server_group_name," ") | eval dest=replace(dest, "dstdomain|src|any-of|dst|# ", ""), dest=replace(mvjoin(dest, " "), "/32", "|"), dest=split(dest, "|"), dest=split(dest, " ") | where rule_name like "acl" | table rule_name, dest, server_group_name] | fillnull value="allow" action | stats values(rule_name) as rule_name values(dest) as dest values(action) as action count by server_group_name</LI-CODE> Fri, 03 Dec 2021 23:09:12 GMT https://community.splunk.com/t5/Splunk-Search/Reduce-the-EVAL-command-SPL/m-p/577293#M201186 youngsuh 2021-12-03T23:09:12Z