Splunk Search

How can I extract multiple email values from a single field in a CSV?

muralianup
Communicator

I have a CSV with a fields Recipient, Sender, File name..etc which is currently set to be monitored from a remote machine (Splunk forwarder installed). The recipient field contains values like these:

abc@test.co.uk, efg@mail.com
rge@abc.com
abc@test.co.uk, efg@mail.com

The parser is capturing the values, but when it comes to multiple recipients, it's taking the whole column as single value. For example: abc@test.co.uk, efg@mail.com as single value.
If I do a stats count by Recipients, I get this:

abc@test.co.uk, efg@mail.com
rge@abc.com

But I want it to extract the emails separately which will should look like this when I do a stats count:

abc@test.co.uk
rger@abc.com
efg@mail.com

Any suggestions?

0 Karma
1 Solution

javiergn
Super Champion

Try this:

Yoursearch | makemv delim="," Recipients| yourstats

View solution in original post

javiergn
Super Champion

Try this:

Yoursearch | makemv delim="," Recipients| yourstats
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...