Splunk Search

How to split a single line which contains multiple field values separated by spaces into multiple fields in Splunk?

pavanae
Builder

I have a csv file query as follows :- 

| inputlookup file_1.csv

which gives the result as follows in a single line as a single field or column 

A B C D E F G H

i j k l m n o p

q r s t u v w x

Now, I want to turn the above result as follows with multiple fields naming A, B,C,D,E,F,G,H basically what I am trying to acheive is convert the single field into multiple fields with each field name or field value is extracted based on a space separation in the single field from above?

ABCDEFGH
ijklmnop
qrstuvwx

 

 

Labels (4)

richgalloway
SplunkTrust
SplunkTrust

rex can do that for you.

| rex "(?<A>\S+)\s(?<A>\S+)\s(?<B>\S+)\s(?<C>\S+)\s(?<E>\S+)\s(?<F>\S+)\s(?<G>\S+)\s(?<H>\S+)\s"

It would be better if you could have the CSV file created as a true comma-separated value file.  Then Splunk would separate the fields automatically.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...