Splunk Search

How to split different field values into separate fields

anuhya_b
Observer

Hello Everyone, I have a field in this format and this information is fetched from a json array.

Label 
apple 1
apple 2
apple 3
banana 1
banana 2
banana 3

 

How can I split this in 

ApplesBananas 
apple 1 banana 1
apple 2banana 2
apple 3banana 3

 

I'm not able to identify what character to use in the split function.I have read various solutions on this page but none of them match this situation. 

Thanks in advance for any help you provide.

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that you cannot identify the split character, and you have the benefit of being able to see the data, how do you expect us to be able to do any better?

Having said that, assuming the split character is a white space, try something like this

| rex field=Label "(?<fruit>\S+)"
| eval {fruit}=Label
| streamstats count as row by fruit
| stats values(*) as * by row
| fields - row fruit Label
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...