https://community.splunk.com/t5/Splunk-Search/How-to-create-an-array-of-values-from-a-field/m-p/107674#M28002 <P>Thanks! <CODE>mvindex</CODE> is the function I was looking for.</P> Tue, 03 Jun 2014 18:38:18 GMT l0pher 2014-06-03T18:38:18Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-array-of-values-from-a-field/m-p/107672#M28000 <P>Hello,</P> <P>I am trying to parse a field like the one below into an array of Key/Value pairs and access each array value separately</P> <P><STRONG>uatoken:</STRONG><BR /> Macintosh; Intel Mac OS X 10_7_5<BR /> Windows NT 6.2; WOW64; rv:22.0<BR /> compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0; ARM; Touch; WPDesktop<BR /> compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0<BR /> compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0<BR /> Android; Mobile; rv:22.0<BR /> Macintosh; Intel Mac OS X 10_7_5<BR /> compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0<BR /> compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0<BR /> Linux; U; Android 4.0.3; en-us; HTC_X515C Build/IML74K<BR /> compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0<BR /> compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0<BR /> Windows NT 6.1; chromeframe/28.0.1500.72<BR /> Macintosh; Intel Mac OS X 10_8_4<BR /> compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0</P> <P>The end result that I am looking for is <BR /> uatoken[0] OR uatoken0=compatible<BR /> uatoken[1] OR uatoken1=MSIE 10.0<BR /> uatoken[2] OR uatoken2=Windows NT 6.1<BR /> uatoken[3] OR uatoken3=Trident/6.0</P> <P>How can I achieve this in Splunk?</P> <P>Thanks in advance!!!</P> Mon, 28 Sep 2020 14:26:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-array-of-values-from-a-field/m-p/107672#M28000 naveenurs 2020-09-28T14:26:22Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-array-of-values-from-a-field/m-p/107673#M28001 <P>I was able to accomplish what I was looking for.</P> <P>eventtype=video|eval uatokentmp=split(uatoken,";")|eval uatoken0=mvindex(uatokentmp,0)|eval uatoken1=mvindex(uatokentmp,1)|eval uatoken2=mvindex(uatokentmp,2)|eval uatoken3=mvindex(uatokentmp,3)|eval uatoken4=mvindex(uatokentmp,4)| eval uatoken5=mvindex(uatokentmp,5)|table uatoken0 uatoken1 uatoken2 uatoken3 uatoken4 uatoken5</P> <P>Is there a better / more efficient way than this to accomplish this?</P> Fri, 26 Jul 2013 16:48:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-array-of-values-from-a-field/m-p/107673#M28001 naveenurs 2013-07-26T16:48:40Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-array-of-values-from-a-field/m-p/107674#M28002 <P>Thanks! <CODE>mvindex</CODE> is the function I was looking for.</P> Tue, 03 Jun 2014 18:38:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-array-of-values-from-a-field/m-p/107674#M28002 l0pher 2014-06-03T18:38:18Z