How to separate fields into events based on value

raby1996 — Wed, 21 Oct 2015 20:24:26 GMT

Hi all

I've been trying to separate the values of a stats table that looks similar to what i have below. I've used different variations of the mvexpand command, however, the problem I face when I try this is that each one of my "Bundle" fields has multiple bundles of the same value combined into the same value (which I count and do calculations to in the background), I.E three 36.56.66.76 are displayed as one field instead of three, but when I try separating them (for export as a csv) it gives me every individual value instead of keeping everything the way it is, and just making new fields with it. Is there any way I can do this?
Thank you. ( P.S the fields would be named Bundle, MM ,and Installs , respectively)

Bundle               MM         Installs
36.46.56.76          32            3
37.47.57.77          33            4
38.48.58.78          40            7

Desired Results- ( where each ----------------- means a new event)

Bundle            MM            Installs
----------------------------------------------
36.46.56.76       32                3
----------------------------------------------
37.47.57.77       33                4
----------------------------------------------
38.48.58.78       40                7

Re: How to separate fields into events based on value

somesoni2 — Wed, 21 Oct 2015 20:52:27 GMT

Providing you current query will help. Meanwhile try this

your current search | eval temp=mvzip(mvzip(Bundle,MM,"#"),Installs,"#") | table temp | mvexpand temp | rex field=temp "(?<Bundle>.*)#(?<MM>.*)#(?<Installs>.*)" | fields - temp

Re: How to separate fields into events based on value

raby1996 — Wed, 21 Oct 2015 21:16:23 GMT

It worked! Thank you.

topic Re: How to separate fields into events based on value in Splunk Search

How to separate fields into events based on value

Re: How to separate fields into events based on value

Re: How to separate fields into events based on value