Splunk Search

Extracting multiple field values from a comma seperated list

Josh
Path Finder

Hello All,

What is the best way to extract into a single field mutiple values from a comma-seperated list:

Example: xxxx Books:1,2,3,65,2,5 xxxxxx

From this I have created a field called Books which contains the string 1,2,3,65,2,5 however what I would like to do is create a field called Books which takes each value as a single entry.

So from the above example I would have 6 entries in the field Book for this particular log entry.

Tags (1)
1 Solution

bwooden
Splunk Employee
Splunk Employee

If you have extracted the field Books with a single value of 1,2,3,65,2,5 and want it to report as a multi-valued attribute, try this at search time:

Books = * | makemv delim="," Books

View solution in original post

bwooden
Splunk Employee
Splunk Employee

If you have extracted the field Books with a single value of 1,2,3,65,2,5 and want it to report as a multi-valued attribute, try this at search time:

Books = * | makemv delim="," Books

Masa
Splunk Employee
Splunk Employee

Just in case, the other option is to use transforms.conf and fields.conf

http://wiki.splunk.com/Community:Comma-Separated_Multi-Value_Field_Extraction_In_Single-line_Event

0 Karma

BunnyHop
Contributor

This can be easily done through regex on your props.conf & transforms.conf:

  • props.conf
[sourcetype_for_the_csv]
REPORT-multifield = multifield
  • transforms.conf
[multifield]
REGEX = Books:(\d+,\d+,\d+,\d+,\d+,\d+)
FORMAT = book::$1
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...