Getting Data In

Is it possible to split comma separated values into a single column using field extraction

nsgalea
New Member

Is it possible to split comma separated values into a single column using field extraction?

for example:

input:
abcd, efgh, ijkl, mnop

output:


    value 1   |    value 2    |    value 3    |   value 4   

      ------------------------------------------------      
     a       |       b       |       c      |     d      
     e       |       f       |       g      |     h      
     i       |       j       |       k      |     l      
     m       |       n       |       o      |     p     

I know I can use something like <List>(?<val1>\w)(?<val2>\w)(?<val3>\w)(?<val4>\w)</list>

however is it possible to repeat the combination an unknown number of times within the brackets?

Tags (2)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="abcd, efgh, ijkl, mnop" 
| rex mode=sed "s/(.*)/value1, value2, value3, value4
\1/g" 
| multikv forceheader=1 
| foreach value* 
    [ eval <<FIELD>> = split(trim('<<FIELD>>'), "")] 
| eval counter = mvrange(0,mvcount(value1)) 
| stats values(value*) as value* by counter 
| foreach value* 
    [ eval <<FIELD>> = mvindex('<<FIELD>>' , counter) ] 
| fields - counter

I don't know what INPUT is, so I make this.
If it is the result of any tallying, we can make it simply.

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval _raw="abcd, efgh, ijkl, mnop, qrstu, vwxy"
| rex max_match=0 "(?<value1>[^\s,]+)(?<value2>[^\s,]+)(?<value3>[^\s,]+)(?<value4>[^\s,]+)"
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes, but it's not pretty.

| makeresults 
| eval input = "abcd, efgh, ijkl, mnop" 
| eval input = split(input, ", ") 
| mvexpand input 
| eval input = split(input, "") 
| streamstats count as v 
| mvexpand input 
| streamstats count as i by v 
| eval value{i} = input 
| stats values(value*) as value* by v 
| fields - v

It's likely that your goal can be achieved with a different approach entirely.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...