Splunk Search

Extracting each value from a multi-valued field

smhsplunk
Communicator

I have a column with some information as follows

traffic_location
ABC 23 EFG RKY
ABC 12 HIJ 23
ABD 23 HIJ 12

ABD 12 KYP 23
ABC 12 RMP 11

This is a single column, the values inside this single column is separated by single spaces.
I would like to access each of the 4 parts to put it in a dropdown menu, hence I need to access
them individually, The values also have many duplicates, so I also want to remove the duplicate.
So far I have this, but its returning me the entire row

source=traffic_information | search * traffic_location | fields traffic_location | dedup traffic_location | eval firstValue=split(traffic_location," ") | search firstValue=1

The other I tried is this

source=traffic_information | search * traffic_location | fields traffic_location | dedup traffic_location | rex "^(?<traffic_location>\w+)" | table traffic_location

But I am getting the entire column and not sure how to get the split parts, can we get eval from rex ?

Please help.

Thanks in Advance.

0 Karma
1 Solution

javiergn
Super Champion

If you know the order of your fields is always the same you could do this:

 source=traffic_information 
| search * traffic_location 
| fields traffic_location 
| dedup traffic_location 
| eval traffic_location=split(traffic_location," ") 
| eval field1 = mvindex(traffic_location, 0)
| eval field2 = mvindex(traffic_location, 1)
| eval field3 = mvindex(traffic_location, 2)
| eval field4 = mvindex(traffic_location, 3)

View solution in original post

sundareshr
Legend

You have couple of options

REX command

source=traffic_information traffic_location=* | rex field=traffic_location "(?<f1>[^\s]+)\s(?<f2>[^\s]+)\s(?<f3>[^\s]+)\s(?<f4>[^\s]+))"

Split command

source=traffic_information traffic_location=* | eval temp=split(traffic_location ," ") | eval f1=mvindex(temp,0)| eval f2=mvindex(temp,1)| eval f3=mvindex(temp,2) | eval f4=mvindex(temp,4)  | fields - temp

javiergn
Super Champion

If you know the order of your fields is always the same you could do this:

 source=traffic_information 
| search * traffic_location 
| fields traffic_location 
| dedup traffic_location 
| eval traffic_location=split(traffic_location," ") 
| eval field1 = mvindex(traffic_location, 0)
| eval field2 = mvindex(traffic_location, 1)
| eval field3 = mvindex(traffic_location, 2)
| eval field4 = mvindex(traffic_location, 3)

smhsplunk
Communicator

Thanks! This is what I was looking for.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...