How to separate a string which contains multiple value but doesn't have delimiter to separate

[Kamal06]

Hi All,

I want to separate a field which contains multiple value within it but doesn't have delimiter on it.

Example:

| makeresults

| eval field1="[email protected]

[email protected]

[email protected]

scheduler"

I have tried to use | eval split = split(field1, " "). But nothing works, Kindly help me out on this like how to separate this single string field as MV field.

Thanks in Advance 

[bowesmana · Accepted solution]

If there is really no delimiter, you can't, but in your case, there is a delimiter, which I am assuming in your example is the line feed at the end of each row. You can either do this by putting a line feed as the split delimiter

| makeresults
| eval field1="[email protected]
[email protected]
[email protected]
scheduler"
| eval x=split(field1, "
")
| eval field1_items=mvcount(field1), fieldx_items=mvcount(x)

or you can use replace+split to change the line feed into something easier to split with, e.g. 

| eval x=split(replace(field1, "\n", "#!#"), "#!#")