Split one field values to set one each value to subsequent rows

[sh254087]

I have OS log data coming from Windows/linux into splunk. I have a particular field with values unseparated. 

Sample log data representation.

_time	parameter	value
x	a c b	x1
x	a c b	x2
x	a c b	x3
y	d e	y1
y	d e	y2

I would want to splint the parameter field's values in such a way that each parameter field will have one of the group values, in same order. Sample output : 

_time	parameter	value
x	a	x1
x	c	x2
x	b	x3
y	d	y1
y	e	y2

Can someone please help?

[Richfez]

How do you know that xa goes with x1 and xc goes with x2?  Like literally I'm looking at your example and I don't know how you would have come up with that correlation.

Can you tell me how you'd do this manually?  Unless we know this, I have no idea how we'd know how to make it work programatically.

[Richfez]

Your *exact* example doesn't make much sense - why would y-d be y1 instead of y2?

But at least some of this may be as simple as "makemv" and/or "mvexpand".

In your example, it appears as if abcde are all multi-value fields (the "mv" in the two above commands).  If that's so,

...
| mvexpand parameter

should make the original into 13 rows.  Once they're separated, perhaps there's some other eval/conditionals you can use to get each output row to include the correct value?

If that doesn't work, you may need something like ...

...
| makemv delim=" " parameter
| mvexpand parameter

In any case I think you'll be two steps closer and we can iterate from there.

happy Splunking,

Rich

[sh254087]

@RichfezThanks for the response, Rich. Since mvexpand/mkemv are basics when it comes to splitting a field value, I had given it a try and tried again now as well. Like you've mentioned, trying this on the example data gives me 13 rows output. But once I'm there, I do not know how to pick one pair of values for a row from the expanded list of values, spread across multiple rows.

Time	parameter	value
x	a	x1
x	c	x1
x	b	x1
x	a	x2
x	c	x2
x	b	x2
x	a	x3
x	c	x3
x	b	x3
y	d	y1
y	e	y1
y	d	y2
y	e	y2

After this, I'm unsure how to achieve the expected output:

Time	parameter	value
x	a	x1
x	c	x2
x	b	x3
y	d	y1
y	e	y2