Splunk Enterprise

How to separate a string which contains multiple value but doesn't have delimiter to separate

Kamal06
Engager

Hi All,

I want to separate a field which contains multiple value within it but doesn't have delimiter on it.

Example:

| makeresults

| eval field1="example1@splunk.com

example@splunk.com

sample@splunk.com

scheduler"

I have tried to use | eval split = split(field1, " "). But nothing works, Kindly help me out on this like how to separate this single string field as MV field.

Thanks in Advance 

 

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If there is really no delimiter, you can't, but in your case, there is a delimiter, which I am assuming in your example is the line feed at the end of each row. You can either do this by putting a line feed as the split delimiter

| makeresults
| eval field1="example1@splunk.com
example@splunk.com
sample@splunk.com
scheduler"
| eval x=split(field1, "
")
| eval field1_items=mvcount(field1), fieldx_items=mvcount(x)

or you can use replace+split to change the line feed into something easier to split with, e.g. 

| eval x=split(replace(field1, "\n", "#!#"), "#!#")

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If there is really no delimiter, you can't, but in your case, there is a delimiter, which I am assuming in your example is the line feed at the end of each row. You can either do this by putting a line feed as the split delimiter

| makeresults
| eval field1="example1@splunk.com
example@splunk.com
sample@splunk.com
scheduler"
| eval x=split(field1, "
")
| eval field1_items=mvcount(field1), fieldx_items=mvcount(x)

or you can use replace+split to change the line feed into something easier to split with, e.g. 

| eval x=split(replace(field1, "\n", "#!#"), "#!#")
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...