Splunk Search
Highlighted

How can I split values based on two possible delimiters?

Communicator
    | eval field2=mvindex(split(word, " "),2) 

How can I split based on either space " " or comma ","
Beforehand, I do not know which delimiter will be there, so I want to use both.

0 Karma
Highlighted

Re: How can I split values based on two possible delimiters?

Motivator

Why don't you rex the space into a comma first and then split on comma only:

your base query to give you word
| rex mode=sed field=word "s/\ /,/g"
| split now on comma here
0 Karma
Highlighted

Re: How can I split values based on two possible delimiters?

SplunkTrust
SplunkTrust

You can use makemv command with tokenizer option to achieve the same. Try something like this

your current search | eval field2=word | makemv tokenizer="(\w+)" field2

OR

your current search | eval field2=word | makemv tokenizer="([^\s,]+)" field2
Highlighted

Re: How can I split values based on two possible delimiters?

Path Finder

Creative solution to make your search a lot less cluttered.

0 Karma
Highlighted

Re: How can I split values based on two possible delimiters?

Legend

You can try replace command on one of the delimiter fields and replace with other delimiter (in following case comma replaced with space) and then use single delimiter for split(in this case only delimiter will be space:

your base search | eval word=replace(word,","," ") | eval field2=mvindex(split(word, " "),2)




| eval message="Happy Splunking!!!"


View solution in original post

Highlighted

Re: How can I split values based on two possible delimiters?

Communicator

how can I skip a space (if field2 is empty) and chose the next character , would I have to use if statement ?

0 Karma
Highlighted

Re: How can I split values based on two possible delimiters?

Legend

Can you give example of that word? If condition can definitely be used.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: How can I split values based on two possible delimiters?

Builder

This is how I wold do it. You take the field where you have the word and then split it inn to two new field.

your search | rex field=word "(?<field1>\w+)[\s,](?<field2>\w+)"

Then you should have first part in field1 and second part in field2

0 Karma