Splunk Search

How do I covert an Object name into columns using a back slash?

shishirkumar
Engager

Hello Team,

Could anyone help me in spiting an Object name into a column name?

Like In Query we are getting Object name as in One Column :

R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt

I wanted to spit that into 6 columns as A ,B,C,D,E,F

The output would be like this

Header table : A |B|C|D|E|F
Row Data : R: |ClientReports|OpenCaseReport|DataFiles|AmeriHealthOpen|CaseReportt_20101210.txt

0 Karma

Vijeta
Influencer

The below query should help you , you can also rename row1, row2 etc. accordingly and display the columns and row that you want using where

  • |makeresults|eval x="R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt"| makemv delim="\" x|mvexpand x| transpose
0 Karma

shishirkumar
Engager

it not working if i am remove hardcoded value that is "R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt" with my column name ?

Could You please help to resolve that.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...