Splunk Search

How can I split values based on two possible delimiters?

smhsplunk
Communicator
    | eval field2=mvindex(split(word, " "),2) 

How can I split based on either space " " or comma ","
Beforehand, I do not know which delimiter will be there, so I want to use both.

0 Karma
1 Solution

niketnilay
Legend

You can try replace command on one of the delimiter fields and replace with other delimiter (in following case comma replaced with space) and then use single delimiter for split(in this case only delimiter will be space:

your base search | eval word=replace(word,","," ") | eval field2=mvindex(split(word, " "),2)

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

lakromani
Builder

This is how I wold do it. You take the field where you have the word and then split it inn to two new field.

your search | rex field=word "(?<field1>\w+)[\s,](?<field2>\w+)"

Then you should have first part in field1 and second part in field2

0 Karma

niketnilay
Legend

You can try replace command on one of the delimiter fields and replace with other delimiter (in following case comma replaced with space) and then use single delimiter for split(in this case only delimiter will be space:

your base search | eval word=replace(word,","," ") | eval field2=mvindex(split(word, " "),2)

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

smhsplunk
Communicator

how can I skip a space (if field2 is empty) and chose the next character , would I have to use if statement ?

0 Karma

niketnilay
Legend

Can you give example of that word? If condition can definitely be used.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

You can use makemv command with tokenizer option to achieve the same. Try something like this

your current search | eval field2=word | makemv tokenizer="(\w+)" field2

OR

your current search | eval field2=word | makemv tokenizer="([^\s,]+)" field2

Yepeza
Path Finder

Creative solution to make your search a lot less cluttered.

0 Karma

gokadroid
Motivator

Why don't you rex the space into a comma first and then split on comma only:

your base query to give you word
| rex mode=sed field=word "s/\ /,/g"
| split now on comma here
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!