Splunk Search

How can I extract multiple email values from a single field in a CSV?

muralianup
Communicator

I have a CSV with a fields Recipient, Sender, File name..etc which is currently set to be monitored from a remote machine (Splunk forwarder installed). The recipient field contains values like these:

abc@test.co.uk, efg@mail.com
rge@abc.com
abc@test.co.uk, efg@mail.com

The parser is capturing the values, but when it comes to multiple recipients, it's taking the whole column as single value. For example: abc@test.co.uk, efg@mail.com as single value.
If I do a stats count by Recipients, I get this:

abc@test.co.uk, efg@mail.com
rge@abc.com

But I want it to extract the emails separately which will should look like this when I do a stats count:

abc@test.co.uk
rger@abc.com
efg@mail.com

Any suggestions?

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Try this:

Yoursearch | makemv delim="," Recipients| yourstats

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Try this:

Yoursearch | makemv delim="," Recipients| yourstats
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...