Splunk Search

How can I extract multiple email values from a single field in a CSV?

Communicator

I have a CSV with a fields Recipient, Sender, File name..etc which is currently set to be monitored from a remote machine (Splunk forwarder installed). The recipient field contains values like these:

abc@test.co.uk, efg@mail.com
rge@abc.com
abc@test.co.uk, efg@mail.com

The parser is capturing the values, but when it comes to multiple recipients, it's taking the whole column as single value. For example: abc@test.co.uk, efg@mail.com as single value.
If I do a stats count by Recipients, I get this:

abc@test.co.uk, efg@mail.com
rge@abc.com

But I want it to extract the emails separately which will should look like this when I do a stats count:

abc@test.co.uk
rger@abc.com
efg@mail.com

Any suggestions?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this:

Yoursearch | makemv delim="," Recipients| yourstats

View solution in original post

SplunkTrust
SplunkTrust

Try this:

Yoursearch | makemv delim="," Recipients| yourstats

View solution in original post