Splunk Search

Need help splitting a single fields values into multiple chunks based on the length.

mjones414
Contributor

I have a situation where I have a multi-value field that can contain anywhere from 1 to 2000 or more values in a day.  each value is exactly 38 characters long.  Each 38 character string is a GUID for another application, and that application can only accept up to 1000 characters at a time.  What I'd like to do is chunk the strings together in complete blocks of 20 which would be 760 characters per block, and then call them by mvindex, but I haven't figured out how to do this in eval so that it will create it whether I have 1 string, 23 strings, or 900 strings to evaluate, since that is always going to be the unknown variable.  Any assistance on how to solve this would be very helpful.


 

 

Labels (2)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming guid doesn't contain commas, and you don't hit some sort of limit on string size (from the mvjoin), you could try something like this

| eval guids=mvjoin(guid,",")
| rex field=guids max_match=0 "(?<group>([^,]+,){1,20}[^,]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Assuming guid doesn't contain commas, and you don't hit some sort of limit on string size (from the mvjoin), you could try something like this

| eval guids=mvjoin(guid,",")
| rex field=guids max_match=0 "(?<group>([^,]+,){1,20}[^,]+)"

mjones414
Contributor

Brilliance!  Sheer Brilliance! Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...