Splunk Enterprise

How to separate a string which contains multiple value but doesn't have delimiter to separate

Kamal06
Engager

Hi All,

I want to separate a field which contains multiple value within it but doesn't have delimiter on it.

Example:

| makeresults

| eval field1="example1@splunk.com

example@splunk.com

sample@splunk.com

scheduler"

I have tried to use | eval split = split(field1, " "). But nothing works, Kindly help me out on this like how to separate this single string field as MV field.

Thanks in Advance 

 

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If there is really no delimiter, you can't, but in your case, there is a delimiter, which I am assuming in your example is the line feed at the end of each row. You can either do this by putting a line feed as the split delimiter

| makeresults
| eval field1="example1@splunk.com
example@splunk.com
sample@splunk.com
scheduler"
| eval x=split(field1, "
")
| eval field1_items=mvcount(field1), fieldx_items=mvcount(x)

or you can use replace+split to change the line feed into something easier to split with, e.g. 

| eval x=split(replace(field1, "\n", "#!#"), "#!#")

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If there is really no delimiter, you can't, but in your case, there is a delimiter, which I am assuming in your example is the line feed at the end of each row. You can either do this by putting a line feed as the split delimiter

| makeresults
| eval field1="example1@splunk.com
example@splunk.com
sample@splunk.com
scheduler"
| eval x=split(field1, "
")
| eval field1_items=mvcount(field1), fieldx_items=mvcount(x)

or you can use replace+split to change the line feed into something easier to split with, e.g. 

| eval x=split(replace(field1, "\n", "#!#"), "#!#")
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...