Splunk Search

Is it possible to use commands like makemv or nomv in data models?

visa87
Explorer

Is it possible to use the commands like makemv or nomv in data models? I am using regular expressions while building the datamodel for extracting some of the fields. One of the fields is a comma separated list in the format [a,b,c] or sometimes it is just [d]. I want a single field which will have possible values as a,b,c,d etc. And all this in the data model. Is it possible to achieve this ?

danbar6
Explorer

You can do this with a calculated field, using an eval looking something like this:

mvfield = split(trim(commafield, "[]"), ",")
0 Karma

spammenot66
Contributor
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...