topic How to extract this field which may have multiple values separated by pipes? (offerId=&quot;ABC_79|ABC_80|ABC_81|ABC_56&quot; or offerId=&quot;ABC_79&quot;) in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-this-field-which-may-have-multiple-values/m-p/252120#M75411 <P>Hi, </P> <P>Can you help me with the search to extract the following? The <STRONG>offerId</STRONG> may come in the log as <CODE>offerId="ABC_79|ABC_80|ABC_81|ABC_56"</CODE> separated by pipes (if there are multiple records) or just <CODE>offerId="ABC_79"</CODE> (if there is just one offer). </P> <P>So how do I extract the offerId's to a new field <STRONG>offerName</STRONG>?</P> <P>The final output would be:<BR /> OfferName:<BR /> ABC_79<BR /> ABC_80<BR /> ABC_81<BR /> ABC_56</P> <P>Thanks.</P> Tue, 29 Sep 2020 08:34:42 GMT Kukkadapu 2020-09-29T08:34:42Z How to extract this field which may have multiple values separated by pipes? (offerId="ABC_79|ABC_80|ABC_81|ABC_56" or offerId="ABC_79") https://community.splunk.com/t5/Splunk-Search/How-to-extract-this-field-which-may-have-multiple-values/m-p/252120#M75411 <P>Hi, </P> <P>Can you help me with the search to extract the following? The <STRONG>offerId</STRONG> may come in the log as <CODE>offerId="ABC_79|ABC_80|ABC_81|ABC_56"</CODE> separated by pipes (if there are multiple records) or just <CODE>offerId="ABC_79"</CODE> (if there is just one offer). </P> <P>So how do I extract the offerId's to a new field <STRONG>offerName</STRONG>?</P> <P>The final output would be:<BR /> OfferName:<BR /> ABC_79<BR /> ABC_80<BR /> ABC_81<BR /> ABC_56</P> <P>Thanks.</P> Tue, 29 Sep 2020 08:34:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-this-field-which-may-have-multiple-values/m-p/252120#M75411 Kukkadapu 2020-09-29T08:34:42Z Re: How to extract this field which may have multiple values separated by pipes? (offerId="ABC_79|ABC_80|ABC_81|ABC_56" or offerId="ABC_79") https://community.splunk.com/t5/Splunk-Search/How-to-extract-this-field-which-may-have-multiple-values/m-p/252121#M75412 <P>Something like this</P> <PRE><CODE>your base search | eval offerName=split(offer_id,"|") </CODE></PRE> <P>OR</P> <PRE><CODE>your base search | makemv offerId delim="|" </CODE></PRE> Fri, 29 Jan 2016 17:06:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-this-field-which-may-have-multiple-values/m-p/252121#M75412 somesoni2 2016-01-29T17:06:13Z Re: How to extract this field which may have multiple values separated by pipes? (offerId="ABC_79|ABC_80|ABC_81|ABC_56" or offerId="ABC_79") https://community.splunk.com/t5/Splunk-Search/How-to-extract-this-field-which-may-have-multiple-values/m-p/252122#M75413 <P>Perfect! It worked . Thanks for your time <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 29 Jan 2016 17:14:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-this-field-which-may-have-multiple-values/m-p/252122#M75413 Kukkadapu 2016-01-29T17:14:13Z