topic Re: How can I split values based on two possible delimiters? in Splunk Search

How can I split values based on two possible delimiters?

smhsplunk — Mon, 07 Nov 2016 21:23:22 GMT

    | eval field2=mvindex(split(word, " "),2)

How can I split based on either space " " or comma ","
Beforehand, I do not know which delimiter will be there, so I want to use both.

Re: How can I split values based on two possible delimiters?

gokadroid — Mon, 07 Nov 2016 21:30:18 GMT

Why don't you rex the space into a comma first and then split on comma only:

your base query to give you word
| rex mode=sed field=word "s/\ /,/g"
| split now on comma here

Re: How can I split values based on two possible delimiters?

somesoni2 — Mon, 07 Nov 2016 22:19:20 GMT

You can use makemv command with tokenizer option to achieve the same. Try something like this

your current search | eval field2=word | makemv tokenizer="(\w+)" field2

your current search | eval field2=word | makemv tokenizer="([^\s,]+)" field2

Re: How can I split values based on two possible delimiters?

niketn — Tue, 08 Nov 2016 05:10:24 GMT

You can try replace command on one of the delimiter fields and replace with other delimiter (in following case comma replaced with space) and then use single delimiter for split(in this case only delimiter will be space:

your base search | eval word=replace(word,","," ") | eval field2=mvindex(split(word, " "),2)

Re: How can I split values based on two possible delimiters?

lakromani — Tue, 08 Nov 2016 06:55:07 GMT

This is how I wold do it. You take the field where you have the word and then split it inn to two new field.

your search | rex field=word "(?<field1>\w+)[\s,](?<field2>\w+)"

Then you should have first part in field1 and second part in field2

Re: How can I split values based on two possible delimiters?

smhsplunk — Wed, 09 Nov 2016 20:12:03 GMT

how can I skip a space (if field2 is empty) and chose the next character , would I have to use if statement ?

Re: How can I split values based on two possible delimiters?

niketn — Wed, 09 Nov 2016 21:41:23 GMT

Can you give example of that word? If condition can definitely be used.

Re: How can I split values based on two possible delimiters?

Yepeza — Tue, 14 Apr 2020 18:20:45 GMT

Creative solution to make your search a lot less cluttered.