Splunk Search

How to break up a single string value in an existing field into a new (multivalued) field with a list of separate values?

ashishlal82
Explorer

I have a field name hosts which has values as:

10.128.193.39,10.128.193.52,10.128.193.47,10.128.193.55,10.128.193.40,10.128.193.49,10.128.193.42,10.128.193.41,10.128.193.37

What functionality within Splunk I can use to strip these addresses and create a new field with a list of all these as separate values rather than just one value that holds all of them? Not sure if I have to use regex?

Output
10.128.193.39
10.128.193.52
10.128.193.47

Tags (2)
0 Karma

sundareshr
Legend

Try this (skip the mvexpand if you want to keep is mv)

... | makemv hosts delim="," | mvexpand hosts
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...