topic Re: How to split multiple fields? in Splunk Search

How to split multiple fields?

paras — Mon, 31 Oct 2022 21:27:24 GMT

I need to be able to split multiple fields that have a delimiter of "|#|". The field name will differ depending on the log. Is there a way to do a mass split using props.conf or transforms.conf. Is there a way to do this without having to write a eval statement for every single field that may come?

EX:

log:: time=XXXX,src_ip="123.123.123.123|#|234.234.234.234|#|",user="foo1|#|foo2|#|foo3"......

I want to split src_ip, and user.

Re: How to split multiple fields?

richgalloway — Tue, 01 Nov 2022 12:58:21 GMT

Use the split function.

| makeresults | eval src_ip="123.123.123.123|#|234.234.234.234|#|",user="foo1|#|foo2|#|foo3" | eval srcs=split(src_ip, "|#|"), users=split(user,"|#|")

You can do it at index time using INGEST_EVAL. In transforms.conf:

INGEST_EVAL srcs=split(src_ip, "|#|") INGEST_EVAL users=split(user,"|#|")

Re: How to split multiple fields?

yuanliu — Tue, 01 Nov 2022 06:16:21 GMT

Whereas you cannot do this in props.conf or transforms.conf, you don't necessarily have to write each split. That's why SPL includes iteration commands such as foreach.

| foreach src_ip, user [eval <<FIELD>> = split(<<FIELD>>, "|#|")]