topic Re: Use split function for two conditions in Splunk Search

Using split function for two conditions?

michaeler — Mon, 06 Feb 2023 22:19:55 GMT

So I have a field named "domain" that has values of single domains (A, B, C) and combinations of domains with two different values.

A
B
C
A/B
A/C
A, B
C, D
I can successfully split the values by either "," or "/" with eval new_field1=(domain,",") but if I do another one after with eval new_field1=(domain,"/") or eval new_field2=(new_field1,"/") after it doesn't work.

Is there a way to split by both "," and "/"

Re: Use split function for two conditions

michaeler — Mon, 06 Feb 2023 21:04:16 GMT

Figured it out...

| eval Ds=split(domain, ",")
| mvexpand Ds
| eval Domain=split(Ds, "/")
| mvexpand Domain

If there is another solution to this I'd love to learn a better way.

Re: Use split function for two conditions

richgalloway — Mon, 06 Feb 2023 21:12:39 GMT

Consider normalizing the data before splitting it.

| eval domain=replace(domain, ", ", "/") | eval domain=split(domain,"/")

Re: Use split function for two conditions

bowesmana — Mon, 06 Feb 2023 23:18:14 GMT

@michaeler

You can do it with a rex statement and a single mvexpand, e.g.

| rex field=domain max_match=0 "\s?(?<Ds>[^,/]*)([,/])?" | mvexpand Ds

The regex will strip out all leading spaces (e.g. the space in your example) and then break out all the matches terminated by either , or /

max_match=0 means it will find all possible matches and make the result an MV field, you can then expand.