Splunk Search

How to split a multivalue field for a data model/pivot table to treat each field value separately?

spammenot66
Contributor

I have a field states, which is delimited by |. For example states=NY|VA|MO|GA
I'm able to get it to expand and treat each as a seperate value:

dedup states | table states | makemv delim="|"  states| mvexpand states|...

How do I do this within a data model and force it to treat each state as a separate value in these scenarios?

0 Karma

ajayabburi508
Path Finder

|eval states=split(states,"|") |mvexpand states | field states

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...