Splunk Search

Makemv command question

bcarr12
Path Finder

What is the best way to use the Makemv command when my logs have no delimiter? For example:

field=abcd

Where a, b, c, and d are unique values. I'm looking to get the count of each in my logs, but I am wondering what the best way would be to delimit them. The values will always be a single letter and the "end" of the field/value pair will be a space. For example:

field1=value1 field=abcd field3=value3

Thanks!

0 Karma
1 Solution

elliotproebstel
Champion

I'd add a delimiter (like a comma) with a regex and then makemv afterwards:

| stats count | eval this="abcd" | rex field=this mode=sed "s/(.)/\1,/g" | makemv delim="," this

View solution in original post

0 Karma

elliotproebstel
Champion

I'd add a delimiter (like a comma) with a regex and then makemv afterwards:

| stats count | eval this="abcd" | rex field=this mode=sed "s/(.)/\1,/g" | makemv delim="," this

0 Karma

bcarr12
Path Finder

Thank you! This was exactly what I needed to do. Much appreciated.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...