Splunk Search

How to split different field values into separate fields

anuhya_b
Observer

Hello Everyone, I have a field in this format and this information is fetched from a json array.

Label 
apple 1
apple 2
apple 3
banana 1
banana 2
banana 3

 

How can I split this in 

ApplesBananas 
apple 1 banana 1
apple 2banana 2
apple 3banana 3

 

I'm not able to identify what character to use in the split function.I have read various solutions on this page but none of them match this situation. 

Thanks in advance for any help you provide.

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that you cannot identify the split character, and you have the benefit of being able to see the data, how do you expect us to be able to do any better?

Having said that, assuming the split character is a white space, try something like this

| rex field=Label "(?<fruit>\S+)"
| eval {fruit}=Label
| streamstats count as row by fruit
| stats values(*) as * by row
| fields - row fruit Label
0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...