topic Re: Remove punctuation from multivalue field and put value in own event in Splunk Search

Removing punctuation from multivalue field and put value in own event?

atebysandwich — Tue, 28 Mar 2023 22:24:04 GMT

I'm pretty sure the answer to my question is regex but I'm not too savy with it.

I have a few values in an IP field formatted like the below example. How can I remove the [] , and ' and get each IP in its own event?

['10.1.1.1', '10.2.2.2']

Re: Remove punctuation from multivalue field and put value in own event

yeahnah — Tue, 28 Mar 2023 20:11:45 GMT

Hi @atebysandwich

Here's a run anywhere example that will meet your needs

| makeresults | eval IPs="['10.1.1.1', '10.2.2.2']" ``` above just creates dummy value ``` | rex field=IPs mode=sed "s/[\[\]']//g" ``` strip unwanted characters to normalise the field ``` | eval IP=split(IPs, ", ") ``` make the field a mutlivalue field ``` | mvexpand IP ``` expand each value to an event ```

Hope this helps

Re: Remove punctuation from multivalue field and put value in own event

richgalloway — Tue, 28 Mar 2023 20:17:17 GMT

It can be done without regex.

| makeresults | eval data="['10.1.1.1','10.2.2.2']" ``` Above defines test data. Delete IRL ``` ``` Break the IP addresses apart ``` | eval data=split(data,",") ``` Put each IP address in its own event ``` | mvexpand data ``` Trim out excess chars ``` | eval data=trim(trim(data,"[]"), "'")

Re: Remove punctuation from multivalue field and put value in own event

atebysandwich — Tue, 28 Mar 2023 20:37:02 GMT

While using your suggestion, the "dummy" data in line two of your suggestion made each event have the same two IPS while the lookup had over 7k. However, I was able to us eth regex and other example of regex to remove the spaces and achieve what I wanted.