How do I split a multi value single field into mul... - Splunk Community

Splunk Search

JSON field=value pairing

i have a log with single field name TestCategories and has multiple values in it like--x,y,z,....

how can i split it and create individual fields like TestCategories1: x and TestCategories2: y

TestCategories: x,y,z,

Hi @MOHITJOSHI

can you use following command

| mvexpand TestCategories

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever. Join us on ...