Getting Data In

How to use split in search?


Hi, how to me use a command split or other command that make two field from one?
Example: Im get a token with text "1** or 2**", I must use this in search | where field=$token$ that get all event with 100-299 number, or using | eval field2=split($token$," or ") and next step using a mvindex(field2, 0), but this not work. And, how to make an exception if in token is "*".


Tags (2)
0 Karma


Can you post a sample of the event and what is currently being extracted? it's hard to understand what you are trying to do.

So a Field called token is extracted and it's value could be a String like "121 or 265"?
You could do an extraction on the token field:

... | rex field=token "(?<token1>\d{3})\sor\s(?<token2>\d{3})"

This will create 2 new fields, token1 and token2

0 Karma

Ultra Champion

From what I understand (but I agree it is a bit unclear), he has a dashboard with a text input, resulting in a token $token$. That text input can contain a search string like "1** or 2**" which he would like to apply to a certain field to filter the results.

You might want to take a look at this (rather old) question and answer about manipulating a token:

Assuming that approach still works, I think that provides all the ingredients needed to solve your challenge as well.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!