Splunk Search

How to break up a single string value in an existing field into a new (multivalued) field with a list of separate values?

ashishlal82
Explorer

I have a field name hosts which has values as:

10.128.193.39,10.128.193.52,10.128.193.47,10.128.193.55,10.128.193.40,10.128.193.49,10.128.193.42,10.128.193.41,10.128.193.37

What functionality within Splunk I can use to strip these addresses and create a new field with a list of all these as separate values rather than just one value that holds all of them? Not sure if I have to use regex?

Output
10.128.193.39
10.128.193.52
10.128.193.47

Tags (2)
0 Karma

sundareshr
Legend

Try this (skip the mvexpand if you want to keep is mv)

... | makemv hosts delim="," | mvexpand hosts
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...