Dashboards & Visualizations

How could I divide one multiple_value field into multiple different value?

Jennifer
Path Finder

Hi, all!

How could I separate this filed into many other fields which is formed by 4 characters?

For example:

The original value         
3138101220477702770431381012204777027704    
3138111620941002204720387701W0193138111620941002204720387701W019 
          

Jennifer_0-1644394965863.png

 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

To create a multi-value field, you could do this

 

| rex max_match=0 field=Call_Sequence "(?<four>.{4})"

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

To create a multi-value field, you could do this

 

| rex max_match=0 field=Call_Sequence "(?<four>.{4})"

 

Jennifer
Path Finder

Thanks so much for your help!

It solves part of the problem! How could I make the new results become three separate rows?

Jennifer_0-1644396678543.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| mvexpand check
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...