So I have a field named "domain" that has values of single domains (A, B, C) and combinations of domains with two different values.
A
B
C
A/B
A/C
A, B
C, D
I can successfully split the values by either "," or "/" with eval new_field1=(domain,",") but if I do another one after with eval new_field1=(domain,"/") or eval new_field2=(new_field1,"/") after it doesn't work.
Is there a way to split by both "," and "/"
You can do it with a rex statement and a single mvexpand, e.g.
| rex field=domain max_match=0 "\s?(?<Ds>[^,/]*)([,/])?"
| mvexpand Ds
The regex will strip out all leading spaces (e.g. the space in your example) and then break out all the matches terminated by either , or /
max_match=0 means it will find all possible matches and make the result an MV field, you can then expand.
Consider normalizing the data before splitting it.
| eval domain=replace(domain, ", ", "/")
| eval domain=split(domain,"/")
Figured it out...
| eval Ds=split(domain, ",")
| mvexpand Ds
| eval Domain=split(Ds, "/")
| mvexpand Domain
If there is another solution to this I'd love to learn a better way.
You can do it with a rex statement and a single mvexpand, e.g.
| rex field=domain max_match=0 "\s?(?<Ds>[^,/]*)([,/])?"
| mvexpand Ds
The regex will strip out all leading spaces (e.g. the space in your example) and then break out all the matches terminated by either , or /
max_match=0 means it will find all possible matches and make the result an MV field, you can then expand.