Getting Data In

Is it possible to split comma separated values into a single column using field extraction

nsgalea
New Member

Is it possible to split comma separated values into a single column using field extraction?

for example:

input:
abcd, efgh, ijkl, mnop

output:


    value 1   |    value 2    |    value 3    |   value 4   

      ------------------------------------------------      
     a       |       b       |       c      |     d      
     e       |       f       |       g      |     h      
     i       |       j       |       k      |     l      
     m       |       n       |       o      |     p     

I know I can use something like <List>(?<val1>\w)(?<val2>\w)(?<val3>\w)(?<val4>\w)</list>

however is it possible to repeat the combination an unknown number of times within the brackets?

Tags (2)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="abcd, efgh, ijkl, mnop" 
| rex mode=sed "s/(.*)/value1, value2, value3, value4
\1/g" 
| multikv forceheader=1 
| foreach value* 
    [ eval <<FIELD>> = split(trim('<<FIELD>>'), "")] 
| eval counter = mvrange(0,mvcount(value1)) 
| stats values(value*) as value* by counter 
| foreach value* 
    [ eval <<FIELD>> = mvindex('<<FIELD>>' , counter) ] 
| fields - counter

I don't know what INPUT is, so I make this.
If it is the result of any tallying, we can make it simply.

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval _raw="abcd, efgh, ijkl, mnop, qrstu, vwxy"
| rex max_match=0 "(?<value1>[^\s,]+)(?<value2>[^\s,]+)(?<value3>[^\s,]+)(?<value4>[^\s,]+)"
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes, but it's not pretty.

| makeresults 
| eval input = "abcd, efgh, ijkl, mnop" 
| eval input = split(input, ", ") 
| mvexpand input 
| eval input = split(input, "") 
| streamstats count as v 
| mvexpand input 
| streamstats count as i by v 
| eval value{i} = input 
| stats values(value*) as value* by v 
| fields - v

It's likely that your goal can be achieved with a different approach entirely.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...