Splunk Search

How can I extract multiple email values from a single field in a CSV?

muralianup
Communicator

I have a CSV with a fields Recipient, Sender, File name..etc which is currently set to be monitored from a remote machine (Splunk forwarder installed). The recipient field contains values like these:

abc@test.co.uk, efg@mail.com
rge@abc.com
abc@test.co.uk, efg@mail.com

The parser is capturing the values, but when it comes to multiple recipients, it's taking the whole column as single value. For example: abc@test.co.uk, efg@mail.com as single value.
If I do a stats count by Recipients, I get this:

abc@test.co.uk, efg@mail.com
rge@abc.com

But I want it to extract the emails separately which will should look like this when I do a stats count:

abc@test.co.uk
rger@abc.com
efg@mail.com

Any suggestions?

0 Karma
1 Solution

javiergn
Super Champion

Try this:

Yoursearch | makemv delim="," Recipients| yourstats

View solution in original post

javiergn
Super Champion

Try this:

Yoursearch | makemv delim="," Recipients| yourstats
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...