Splunk Enterprise

Regex to parse a string with commas

asdfxqwert
Explorer

I have a field with values like below

(a)

(a,b)

(c)

(a,c)

 

I am trying to parse these values, and get stats like below 

 

a 3

b 1

c 2

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you can try this

| makeresults 
| eval _raw="F1
(a)
(a,b)
(c)
(a,c)"
| multikv forceheader=1
```Above generates sample data```
| rex mode=sed field=F1 "s/[\(\)]//g"
| makemv delim="," F1
| mvexpand F1
| stats count by F1

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you can try this

| makeresults 
| eval _raw="F1
(a)
(a,b)
(c)
(a,c)"
| multikv forceheader=1
```Above generates sample data```
| rex mode=sed field=F1 "s/[\(\)]//g"
| makemv delim="," F1
| mvexpand F1
| stats count by F1

r. Ismo 

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...