Splunk Search

How to break up a single string value in an existing field into a new (multivalued) field with a list of separate values?

ashishlal82
Explorer

I have a field name hosts which has values as:

10.128.193.39,10.128.193.52,10.128.193.47,10.128.193.55,10.128.193.40,10.128.193.49,10.128.193.42,10.128.193.41,10.128.193.37

What functionality within Splunk I can use to strip these addresses and create a new field with a list of all these as separate values rather than just one value that holds all of them? Not sure if I have to use regex?

Output
10.128.193.39
10.128.193.52
10.128.193.47

Tags (2)
0 Karma

sundareshr
Legend

Try this (skip the mvexpand if you want to keep is mv)

... | makemv hosts delim="," | mvexpand hosts
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...