Using split function for two conditions?

[michaeler]

So I have a field named "domain" that has values of single domains (A, B, C) and combinations of domains with two different values.

A
B
C
A/B
A/C
A, B
C, D
I can successfully split the values by either "," or "/" with eval new_field1=(domain,",") but if I do another one after with eval new_field1=(domain,"/") or eval new_field2=(new_field1,"/") after it doesn't work.

Is there a way to split by both "," and "/"

[richgalloway]

Consider normalizing the data before splitting it.

| eval domain=replace(domain, ", ", "/")
| eval domain=split(domain,"/")

[michaeler]

Figured it out...

| eval Ds=split(domain, ",")
| mvexpand Ds
| eval Domain=split(Ds, "/")
| mvexpand Domain

If there is another solution to this I'd love to learn a better way.

[bowesmana · Accepted solution]

@michaeler 

You can do it with a rex statement and a single mvexpand, e.g.

| rex field=domain max_match=0 "\s?(?<Ds>[^,/]*)([,/])?"
| mvexpand Ds

The regex will strip out all leading spaces (e.g. the space in your example) and then break out all the matches terminated by either , or /

max_match=0 means it will find all possible matches and make the result an MV field, you can then expand.