Splunk Search

How to split a single line which contains multiple field values separated by spaces into multiple fields in Splunk?

pavanae
Builder

I have a csv file query as follows :- 

| inputlookup file_1.csv

which gives the result as follows in a single line as a single field or column 

A B C D E F G H

i j k l m n o p

q r s t u v w x

Now, I want to turn the above result as follows with multiple fields naming A, B,C,D,E,F,G,H basically what I am trying to acheive is convert the single field into multiple fields with each field name or field value is extracted based on a space separation in the single field from above?

ABCDEFGH
ijklmnop
qrstuvwx

 

 

Labels (4)

richgalloway
SplunkTrust
SplunkTrust

rex can do that for you.

| rex "(?<A>\S+)\s(?<A>\S+)\s(?<B>\S+)\s(?<C>\S+)\s(?<E>\S+)\s(?<F>\S+)\s(?<G>\S+)\s(?<H>\S+)\s"

It would be better if you could have the CSV file created as a true comma-separated value file.  Then Splunk would separate the fields automatically.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...