topic How to achieve field with a value containing commas? in Splunk Search

How to achieve field with a value containing commas?

Yossarian622 — Wed, 15 Feb 2023 20:54:10 GMT

Unfortunately I have no control over the log data formatting...

it is in format: Field1=Value1|Field2=Value2| ... |Criteria=one,two,three,99.0|...

I have one field, Criteria, that has many values with embedded commas.

Splunk search only give me the first value... I want all values treated as one in a stats count by

I tried below to rewrite them, and do see the changes, but stats still getting only first value.

index=myidx Msg=mymsg | rex mode=sed field=_raw "s/,/-/g"
| bucket span=1d _time as ts
| eval ts=strftime(ts,"%Y-%m-%d")
| stats count by ts Criteria

yuanliu — Wed, 15 Feb 2023 21:15:11 GMT

It is unfortunate that the log isn't quoted as we would have liked. Fortunately, it is formatted well enough for kv aka extract command.

| kv pairdelim="|" ``` kvdelim defaults to "=" so it can be omitted ```

Yossarian622 — Wed, 15 Feb 2023 21:51:11 GMT

I added: | kv pairdelim="|"

but stats is still only showing me the first value before the comma

or - if i keep the rex mode=sed field=_raw "s/,/-/g"

yuanliu — Wed, 15 Feb 2023 21:54:49 GMT

Sorry for misleading you about kvdelim. You still need it when the string is not quoted.

| makeresults
| fields - _time
| eval _raw = "Field1=Value1|Field2=Value2| ... |Criteria=one,two,three,99.0|..."
| kv pairdelim="|" kvdelim="="

Criteria	Field1	Field2	_raw
one,two,three,99.0	Value1	Value2	Field1=Value1\|Field2=Value2\| ... \|Criteria=one,two,three,99.0\|...

Yossarian622 — Thu, 16 Feb 2023 16:40:50 GMT

sorry but I am still only getting the first value before the comma/hyphen.

do I need to re eval the whole line?

Yossarian622 — Thu, 16 Feb 2023 17:13:01 GMT

sorry but I am still only getting the first value before the first comma

do I need to do a re eval

should I be using mvindex in some form?

yuanliu — Fri, 17 Feb 2023 06:33:44 GMT

Let's go back to your data. The illustrated format, is it raw event or is it from one field? What is the command that you last tried?