Splunk Search

How to break up a single string value in an existing field into a new (multivalued) field with a list of separate values?

ashishlal82
Explorer

I have a field name hosts which has values as:

10.128.193.39,10.128.193.52,10.128.193.47,10.128.193.55,10.128.193.40,10.128.193.49,10.128.193.42,10.128.193.41,10.128.193.37

What functionality within Splunk I can use to strip these addresses and create a new field with a list of all these as separate values rather than just one value that holds all of them? Not sure if I have to use regex?

Output
10.128.193.39
10.128.193.52
10.128.193.47

Tags (2)
0 Karma

sundareshr
Legend

Try this (skip the mvexpand if you want to keep is mv)

... | makemv hosts delim="," | mvexpand hosts
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...