Splunk Search

split filed into multiple filed

abhijeet
Explorer

I would like to break "X" field into multiple field based on available value. "X" contain data in following format. 

Field X-

ABC: YES, APPLICATION: DEF, ZONE: DATA, ENVIRONMENT: DEV

ZONE: INSIDE, ENVIRONMENT: PROD

ZONE: OUTSIDE, ENVIRONMENT: DEV, ABC: YES, APPLICATION: IJK

=======

I would like the arrange data in following format.

 

ABC     APPLICATION             ZONE           ENVIRONMENT

YES           DEF                          DATA                      DEV

                                                     INSIDE                  PROD

YES           IJK                           OUTSIDE             DEV

 

TIA. 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The bit before the blank lines just sets up dummy data for the runanywhere example

| makeresults 
| eval X=split("ABC: YES, APPLICATION: DEF, ZONE: DATA, ENVIRONMENT: DEV|ZONE: INSIDE, ENVIRONMENT: PROD|ZONE: OUTSIDE, ENVIRONMENT: DEV, ABC: YES, APPLICATION: IJK","|")
| mvexpand X


| eval _raw=X
| extract pairdelim="," kvdelim=":"

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The bit before the blank lines just sets up dummy data for the runanywhere example

| makeresults 
| eval X=split("ABC: YES, APPLICATION: DEF, ZONE: DATA, ENVIRONMENT: DEV|ZONE: INSIDE, ENVIRONMENT: PROD|ZONE: OUTSIDE, ENVIRONMENT: DEV, ABC: YES, APPLICATION: IJK","|")
| mvexpand X


| eval _raw=X
| extract pairdelim="," kvdelim=":"

 

abhijeet
Explorer

Thank you so much. Solution works... 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...