Splunk Search

Makemv command question

bcarr12
Path Finder

What is the best way to use the Makemv command when my logs have no delimiter? For example:

field=abcd

Where a, b, c, and d are unique values. I'm looking to get the count of each in my logs, but I am wondering what the best way would be to delimit them. The values will always be a single letter and the "end" of the field/value pair will be a space. For example:

field1=value1 field=abcd field3=value3

Thanks!

0 Karma
1 Solution

elliotproebstel
Champion

I'd add a delimiter (like a comma) with a regex and then makemv afterwards:

| stats count | eval this="abcd" | rex field=this mode=sed "s/(.)/\1,/g" | makemv delim="," this

View solution in original post

0 Karma

elliotproebstel
Champion

I'd add a delimiter (like a comma) with a regex and then makemv afterwards:

| stats count | eval this="abcd" | rex field=this mode=sed "s/(.)/\1,/g" | makemv delim="," this

0 Karma

bcarr12
Path Finder

Thank you! This was exactly what I needed to do. Much appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...