Getting Data In

How split up a sentence string into multiple words

ibowman1995
Engager

Hi,
let's say there is a field like this:
userData= Split this string

Is it possible to extract this sentence into different fields?
userData1=split
userData2=this
userData3=string

Tags (2)
0 Karma
1 Solution

dindu
Contributor

Hi,

You could try this as well.
Please test and let us know.

| makeresults 
| eval userData="Split this string"
|table userData
|eval words=split(userData," ")
|eval userData1=mvindex(words,0),userData2=mvindex(words,1),userData3=mvindex(words,2)

View solution in original post

dindu
Contributor

Hi,

You could try this as well.
Please test and let us know.

| makeresults 
| eval userData="Split this string"
|table userData
|eval words=split(userData," ")
|eval userData1=mvindex(words,0),userData2=mvindex(words,1),userData3=mvindex(words,2)

to4kawa
Ultra Champion

Hi, @ibowman1995
Yes, you can. try this.

| makeresults 
| eval userData="Split this string"
| rex field=userData "(?<userData1>[^ ]+) (?<userData2>[^ ]+) (?<userData3>[^ ]+)"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible. Look in the search docs for split. It returns a multi-value field with the words from the original string. Use mvindex() to access them.

... | eval words = split(userData, " ") 
| eval userData1=mvindex(userData, 0), userData2=mvindex(userData,1), userData3=mvindex(userData, 2)
---
If this reply helps you, Karma would be appreciated.

jacono64
Engager

i can confirm this works bc i had multiple fields in one string.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...