Splunk Search

Split apart MV column into other columns

dcase999
Engager

Hi,

I have a MV field that I need to split apart into other mv fields

Here is the result of the query

dcase999_0-1624379599124.png

 

What I want it to look like is

dcase999_1-1624379947828.png

 

I've been fighting with MV commands but nothing seems to work quite like I wanted it to sooooo I figured I'd raise my hand and ask the Splunk Wizards :slightly_smiling_face:

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval Criticality=1, Application="APblah", Name="Fred Flintstone", Dependencies=split("APsomeotherblah,DNSsomething,C-Ssomeserver,C-Ssomeotherserver",",")
| table Criticality Application Name Dependencies
| eval Servers=mvfilter(match(Dependencies,"^C-S.*"))
| eval Applications=mvfilter(NOT match(Dependencies,"^C-S.*"))

View solution in original post

0 Karma

dcase999
Engager

ok, wow that is most impressive!  Many thanks @ITWhisperer !!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

First of all, you can't have two columns (fields) with the same name. Secondly, how do you know which dependency is an(other) application and which is a server?

0 Karma

dcase999
Engager

ooops on the application name - you are right, that can be changed to anything else

On the "what is an application vs what is a server" question, anything that begins with C-S would be a server, anything else would be an application.

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval Criticality=1, Application="APblah", Name="Fred Flintstone", Dependencies=split("APsomeotherblah,DNSsomething,C-Ssomeserver,C-Ssomeotherserver",",")
| table Criticality Application Name Dependencies
| eval Servers=mvfilter(match(Dependencies,"^C-S.*"))
| eval Applications=mvfilter(NOT match(Dependencies,"^C-S.*"))
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...