topic Re: How to split and result of max_match in Splunk Search

How to split the result of max_match?

haiweichen — Tue, 16 Aug 2022 23:28:31 GMT

The values I need are located in the field "msg". Each msg contains 3 records. I run this query and get the result as below,

Date Restaurant Type Status

2021-03-10 2022-01-04 2021-05-01	Domino SOUTHERN RESTAURANTS TRUST MCDONALD'S	A B A	NEW USED USED
2021-03-11 2021-03-12 2022-02-05	KFC Domino MCDONALD'S	C B A	NEW NEW USED
2021-03-11 2021-12-20 2021-05-09	Rooster CYREN BAR MCDONALD'S	A A B	NEW USED USED
2021-03-12 2021-12-18 2021-06-22	Helo KFC MCDONALD'S	A A B	NEW USED USED
2021-03-12 2022-01-05 2022-01-14	KFC MCDONALD'S MCDONALD'S	A A B

The question is, how can I make each record separated? I would like to use query "where restaurant=KFC" to look for specific restaurant.

ITWhisperer — Tue, 16 Aug 2022 10:32:03 GMT

haiweichen — Tue, 16 Aug 2022 22:45:34 GMT

That's great! It works for my case.