Split multi-valued field

[bcarr12]

Hi all,

What would be the best way to split values out of a field that I know are multi-valued, but are written as one long string?

For example:

field=VALUE --> V is a unique value, A is a unique value, L is a unique value, etc

this field could have unique patterns, such as:

field=V
field=VL (V in a unique value, L is a unique value)
field=VU (V is a unique value, U is a unique value)
field=AL (A is a unique value, L is a unique value)
etc...

[DalJeanis]

How many different potential values are we talking about?

Do you have an exhaustive list of the potential values, or might there be "leftovers"

| makeresults | eval myfield="V VL VU AL AXV ZTU" |makemv myfield | mvexpand myfield | table myfield
| rename COMMENT as "The above inputs your sample data, plus a couple of other use cases"

| rename COMMENT as "Pull out the values we know about"
| rex field=myfield "(?<subfield>A|L|U|V)" max_match=0

| rename COMMENT as "Calculate anything left by deleting the stuff already captured"
| eval remainder=myfield
| rex field=remainder mode=sed "s/A|L|U|V//g"

| rename COMMENT as "Concatenate the remainder onto the end of the capture field, sort and dedup"
| eval subfield2=mvdedup(mvappend(subfield,remainder))

Basically, the A|L|U|V is the only thing you need to code and be careful of. Make sure that if there is any overlap between the capture values, that the longer one is placed first. For example, if app and apple and grapple and grappa are potential values, then these orders are correct - grapple|apple|grappa|app or grappa|grapple|apple|app. (There are a couple more potentially correct versions, but you get the idea.)

If you want the values you identify and pull out to be case-insensitive, then change these two lines to include (?i) -

| rex field=myfield "(?i)(?<subfield>A|L|U|V)" max_match=0

| rex field=remainder mode=sed "s/(?i)A|L|U|V//g"

[bcarr12]

Appreciate the suggestion, unfortunately there are too many different combinations so this solution may not work. Maybe I just need to do something as simple as adding a delimeter between each value and then use the split command from there? Just not sure of the best way to add a delimeter in where there currently isn't one.

[woodcock]

Use the split command:
http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/TextFunctions#split.28X.2C.22Y.22....

[bcarr12]

Thanks for the suggestion, I think this would work if the values were delimited by something, but in this case the values are not delimited by anything