Splunk Search

How to split data into multiple columns?

ayush1906
Path Finder

I am having data in a single field in this format:
1. xyz 2. dsh bh 3. sdh dsd() 4. trrt .... so on

I want to split this data into multiple column like this

no.  |    name
1           xyz
2          dsh bh
3          sdh dsd
4          trrt

I have tried using delimiter but not getting the expected result.

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @ayush1906,

Based on sample data you can try below query

<yourBaseSearch>
| rex field=_raw "(?<a>\d+)\.\s(?<b>[^\d]*)(?:$|\s)" max_match=0
| eval c=mvzip(a,b)
| mvexpand c
| eval no=mvindex(split(c,","),0), name=mvindex(split(c,","),1)
| rex field=name mode=sed "s/\(\)//g"
| table no, name

Here is run anywhere search based on sample data

| makeresults
| eval _raw="1. xyz 2. dsh bh 3. sdh dsd() 4. trrt"
| rex field=_raw "(?<a>\d+)\.\s(?<b>[^\d]*)(?:$|\s)" max_match=0
| eval c=mvzip(a,b)
| mvexpand c
| eval no=mvindex(split(c,","),0), name=mvindex(split(c,","),1)
| rex field=name mode=sed "s/\(\)//g"
| table no, name

View solution in original post

0 Karma

vnravikumar
Champion

Hi @ayush1906

Try like

| makeresults 
| eval msg="1. xyz 2. dsh bh 3. sdh dsd() 4. trrt" 
| rex field=msg max_match=0 "(?P<no>\d+).\s(?P<name>[a-z\s]*)"
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @ayush1906,

Based on sample data you can try below query

<yourBaseSearch>
| rex field=_raw "(?<a>\d+)\.\s(?<b>[^\d]*)(?:$|\s)" max_match=0
| eval c=mvzip(a,b)
| mvexpand c
| eval no=mvindex(split(c,","),0), name=mvindex(split(c,","),1)
| rex field=name mode=sed "s/\(\)//g"
| table no, name

Here is run anywhere search based on sample data

| makeresults
| eval _raw="1. xyz 2. dsh bh 3. sdh dsd() 4. trrt"
| rex field=_raw "(?<a>\d+)\.\s(?<b>[^\d]*)(?:$|\s)" max_match=0
| eval c=mvzip(a,b)
| mvexpand c
| eval no=mvindex(split(c,","),0), name=mvindex(split(c,","),1)
| rex field=name mode=sed "s/\(\)//g"
| table no, name
0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...