Splunk Search

Split apart MV column into other columns

dcase999
Engager

Hi,

I have a MV field that I need to split apart into other mv fields

Here is the result of the query

dcase999_0-1624379599124.png

 

What I want it to look like is

dcase999_1-1624379947828.png

 

I've been fighting with MV commands but nothing seems to work quite like I wanted it to sooooo I figured I'd raise my hand and ask the Splunk Wizards 🙂

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval Criticality=1, Application="APblah", Name="Fred Flintstone", Dependencies=split("APsomeotherblah,DNSsomething,C-Ssomeserver,C-Ssomeotherserver",",")
| table Criticality Application Name Dependencies
| eval Servers=mvfilter(match(Dependencies,"^C-S.*"))
| eval Applications=mvfilter(NOT match(Dependencies,"^C-S.*"))

View solution in original post

0 Karma

dcase999
Engager

ok, wow that is most impressive!  Many thanks @ITWhisperer !!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

First of all, you can't have two columns (fields) with the same name. Secondly, how do you know which dependency is an(other) application and which is a server?

0 Karma

dcase999
Engager

ooops on the application name - you are right, that can be changed to anything else

On the "what is an application vs what is a server" question, anything that begins with C-S would be a server, anything else would be an application.

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval Criticality=1, Application="APblah", Name="Fred Flintstone", Dependencies=split("APsomeotherblah,DNSsomething,C-Ssomeserver,C-Ssomeotherserver",",")
| table Criticality Application Name Dependencies
| eval Servers=mvfilter(match(Dependencies,"^C-S.*"))
| eval Applications=mvfilter(NOT match(Dependencies,"^C-S.*"))
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...