topic How to split different field values into separate fields in Splunk Search

How to split different field values into separate fields

anuhya_b — Mon, 07 Nov 2022 07:24:43 GMT

Hello Everyone, I have a field in this format and this information is fetched from a json array.

Label

apple 1

apple 2

apple 3

banana 1

banana 2

banana 3

How can I split this in

Apples	Bananas
apple 1	banana 1
apple 2	banana 2
apple 3	banana 3

I'm not able to identify what character to use in the split function.I have read various solutions on this page but none of them match this situation.

Thanks in advance for any help you provide.

Re: How to split different field values into separate fields

ITWhisperer — Mon, 07 Nov 2022 08:12:10 GMT

Given that you cannot identify the split character, and you have the benefit of being able to see the data, how do you expect us to be able to do any better?

Having said that, assuming the split character is a white space, try something like this

| rex field=Label "(?<fruit>\S+)" | eval {fruit}=Label | streamstats count as row by fruit | stats values(*) as * by row | fields - row fruit Label