topic Re: Splitting Data in a single Cell in Splunk Search

How to split data in a single cell?

MR1992 — Wed, 15 Mar 2023 18:38:39 GMT

I have the following data in a Cell that reads

1.01.01 Example App AL11111

Is there a way I can split the data into 3 separate columns, there are no delimiters, I thought using space but I have entries that do have spaces in the middle section.

e.g.

1.1.1.10

Example App

AL11111

One thing to note, the initial numbers will always be 8 characters long and the AL***** will always be 7 characters

Thanks

Re: Splitting Data in a single Cell

ITWhisperer — Wed, 15 Mar 2023 14:30:14 GMT

Your initial example only has 7 characters in the first part, so this would work

| rex "(?<field1>[^\s]+)\s(?<field2>.*)\s(?<field3>[^\s]*)"

If you want to be more strict, try this

| rex "(?<field1>[^\s]{8})\s(?<field2>.*)\s(?<field3>[^\s]{7})"

Re: Splitting Data in a single Cell

MR1992 — Wed, 15 Mar 2023 15:02:25 GMT

This worked perfectly, thank you