Getting Data In

How to split single line field value into multiple lines using regex?

pavanae
Builder

I have a field value in splunk with the below format  :- 

 

field_X = "AB 012 - some text here! ---- HOST INFORMATION: ---- Source: 1.1.2.3 ---- DETAILS: -- Destination ports: 777 33 -- Occurrences: 2244 -- Destination ip counts: 146 -- Actions: blocked -- Order Techniques : X3465 "

Now How can I split the abpve field value into multiple lines to make it more user redable using eval and regex

field_X = 
AB 012 - some text here! 
HOST INFORMATION: 
Source: 1.1.2.3 
DETAILS: 
Destination ports: 777 33 
Occurrences: 2244 
Destination ip counts: 146 
Actions: blocked 
Order Techniques : X3465 

 

All I wanted is replace "--" with a line space or something to divide the field into multiple lines from 1 line?

Labels (1)
Tags (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See this example

| makeresults
| eval field_X = "AB 012 - some text here! ---- HOST INFORMATION: ---- Source: 1.1.2.3 ---- DETAILS: -- Destination ports: 777 33 -- Occurrences: 2244 -- Destination ip counts: 146 -- Actions: blocked -- Order Techniques : X3465 "
| makemv delim="--" field_X
| eval field_X=trim(field_X)

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

See this example

| makeresults
| eval field_X = "AB 012 - some text here! ---- HOST INFORMATION: ---- Source: 1.1.2.3 ---- DETAILS: -- Destination ports: 777 33 -- Occurrences: 2244 -- Destination ip counts: 146 -- Actions: blocked -- Order Techniques : X3465 "
| makemv delim="--" field_X
| eval field_X=trim(field_X)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Note that field_X will then be a multi-value field with 9 values

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...