Splunk Search

How to split data into multiple columns?

ayush1906
Path Finder

I am having data in a single field in this format:
1. xyz 2. dsh bh 3. sdh dsd() 4. trrt .... so on

I want to split this data into multiple column like this

no.  |    name
1           xyz
2          dsh bh
3          sdh dsd
4          trrt

I have tried using delimiter but not getting the expected result.

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @ayush1906,

Based on sample data you can try below query

<yourBaseSearch>
| rex field=_raw "(?<a>\d+)\.\s(?<b>[^\d]*)(?:$|\s)" max_match=0
| eval c=mvzip(a,b)
| mvexpand c
| eval no=mvindex(split(c,","),0), name=mvindex(split(c,","),1)
| rex field=name mode=sed "s/\(\)//g"
| table no, name

Here is run anywhere search based on sample data

| makeresults
| eval _raw="1. xyz 2. dsh bh 3. sdh dsd() 4. trrt"
| rex field=_raw "(?<a>\d+)\.\s(?<b>[^\d]*)(?:$|\s)" max_match=0
| eval c=mvzip(a,b)
| mvexpand c
| eval no=mvindex(split(c,","),0), name=mvindex(split(c,","),1)
| rex field=name mode=sed "s/\(\)//g"
| table no, name

View solution in original post

0 Karma

vnravikumar
Champion

Hi @ayush1906

Try like

| makeresults 
| eval msg="1. xyz 2. dsh bh 3. sdh dsd() 4. trrt" 
| rex field=msg max_match=0 "(?P<no>\d+).\s(?P<name>[a-z\s]*)"
0 Karma

harsmarvania57
Ultra Champion

Hi @ayush1906,

Based on sample data you can try below query

<yourBaseSearch>
| rex field=_raw "(?<a>\d+)\.\s(?<b>[^\d]*)(?:$|\s)" max_match=0
| eval c=mvzip(a,b)
| mvexpand c
| eval no=mvindex(split(c,","),0), name=mvindex(split(c,","),1)
| rex field=name mode=sed "s/\(\)//g"
| table no, name

Here is run anywhere search based on sample data

| makeresults
| eval _raw="1. xyz 2. dsh bh 3. sdh dsd() 4. trrt"
| rex field=_raw "(?<a>\d+)\.\s(?<b>[^\d]*)(?:$|\s)" max_match=0
| eval c=mvzip(a,b)
| mvexpand c
| eval no=mvindex(split(c,","),0), name=mvindex(split(c,","),1)
| rex field=name mode=sed "s/\(\)//g"
| table no, name
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...