Splunk Search

How to split a single line which contains multiple field values separated by spaces into multiple fields in Splunk?

pavanae
Builder

I have a csv file query as follows :- 

| inputlookup file_1.csv

which gives the result as follows in a single line as a single field or column 

A B C D E F G H

i j k l m n o p

q r s t u v w x

Now, I want to turn the above result as follows with multiple fields naming A, B,C,D,E,F,G,H basically what I am trying to acheive is convert the single field into multiple fields with each field name or field value is extracted based on a space separation in the single field from above?

ABCDEFGH
ijklmnop
qrstuvwx

 

 

Labels (4)

richgalloway
SplunkTrust
SplunkTrust

rex can do that for you.

| rex "(?<A>\S+)\s(?<A>\S+)\s(?<B>\S+)\s(?<C>\S+)\s(?<E>\S+)\s(?<F>\S+)\s(?<G>\S+)\s(?<H>\S+)\s"

It would be better if you could have the CSV file created as a true comma-separated value file.  Then Splunk would separate the fields automatically.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...