Split apart MV column into other columns

[dcase999]

Hi,

I have a MV field that I need to split apart into other mv fields

Here is the result of the query

What I want it to look like is

I've been fighting with MV commands but nothing seems to work quite like I wanted it to sooooo I figured I'd raise my hand and ask the Splunk Wizards 🙂

[dcase999]

ok, wow that is most impressive!  Many thanks @ITWhisperer !!!!

[ITWhisperer]

First of all, you can't have two columns (fields) with the same name. Secondly, how do you know which dependency is an(other) application and which is a server?

[dcase999]

ooops on the application name - you are right, that can be changed to anything else

On the "what is an application vs what is a server" question, anything that begins with C-S would be a server, anything else would be an application.

[ITWhisperer · Accepted solution]

| makeresults 
| eval Criticality=1, Application="APblah", Name="Fred Flintstone", Dependencies=split("APsomeotherblah,DNSsomething,C-Ssomeserver,C-Ssomeotherserver",",")
| table Criticality Application Name Dependencies
| eval Servers=mvfilter(match(Dependencies,"^C-S.*"))
| eval Applications=mvfilter(NOT match(Dependencies,"^C-S.*"))