I have a csv file query as follows :-
| inputlookup file_1.csv
which gives the result as follows in a single line as a single field or column
A B C D E F G H
i j k l m n o p
q r s t u v w x
Now, I want to turn the above result as follows with multiple fields naming A, B,C,D,E,F,G,H basically what I am trying to acheive is convert the single field into multiple fields with each field name or field value is extracted based on a space separation in the single field from above?
A | B | C | D | E | F | G | H |
i | j | k | l | m | n | o | p |
q | r | s | t | u | v | w | x |
rex can do that for you.
| rex "(?<A>\S+)\s(?<A>\S+)\s(?<B>\S+)\s(?<C>\S+)\s(?<E>\S+)\s(?<F>\S+)\s(?<G>\S+)\s(?<H>\S+)\s"
It would be better if you could have the CSV file created as a true comma-separated value file. Then Splunk would separate the fields automatically.