Splunk Search

How can I extract multiple email values from a single field in a CSV?

muralianup
Communicator

I have a CSV with a fields Recipient, Sender, File name..etc which is currently set to be monitored from a remote machine (Splunk forwarder installed). The recipient field contains values like these:

abc@test.co.uk, efg@mail.com
rge@abc.com
abc@test.co.uk, efg@mail.com

The parser is capturing the values, but when it comes to multiple recipients, it's taking the whole column as single value. For example: abc@test.co.uk, efg@mail.com as single value.
If I do a stats count by Recipients, I get this:

abc@test.co.uk, efg@mail.com
rge@abc.com

But I want it to extract the emails separately which will should look like this when I do a stats count:

abc@test.co.uk
rger@abc.com
efg@mail.com

Any suggestions?

0 Karma
1 Solution

javiergn
Super Champion

Try this:

Yoursearch | makemv delim="," Recipients| yourstats

View solution in original post

javiergn
Super Champion

Try this:

Yoursearch | makemv delim="," Recipients| yourstats
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...