topic Re: Need help splitting a single fields values into multiple chunks based on the length. in Splunk Search

Need help splitting a single fields values into multiple chunks based on the length.

mjones414 — Thu, 23 Feb 2023 15:49:54 GMT

I have a situation where I have a multi-value field that can contain anywhere from 1 to 2000 or more values in a day. each value is exactly 38 characters long. Each 38 character string is a GUID for another application, and that application can only accept up to 1000 characters at a time. What I'd like to do is chunk the strings together in complete blocks of 20 which would be 760 characters per block, and then call them by mvindex, but I haven't figured out how to do this in eval so that it will create it whether I have 1 string, 23 strings, or 900 strings to evaluate, since that is always going to be the unknown variable. Any assistance on how to solve this would be very helpful.

Re: Need help splitting a single fields values into multiple chunks based on the length.

ITWhisperer — Thu, 23 Feb 2023 16:04:39 GMT

Assuming guid doesn't contain commas, and you don't hit some sort of limit on string size (from the mvjoin), you could try something like this

| eval guids=mvjoin(guid,",") | rex field=guids max_match=0 "(?<group>([^,]+,){1,20}[^,]+)"

Re: Need help splitting a single fields values into multiple chunks based on the length.

mjones414 — Thu, 23 Feb 2023 18:21:23 GMT

Brilliance! Sheer Brilliance! Thank you so much!