Replacing carriage return with special character

[ajdyer2000]

Hi,

Results of a search returns computer name and IPaddress separated by a carriage return

ComputerName [carriage return] ip Adress

I would like to separate them into 2 separate fields

Computername Ipaddresss

OR

Replace

[aaraneta_splunk]

Hi @ajdyer200 - I received a notification that you accepted sundareshr's answer but here it is unaccepted. Did you accidentally unaccept the answer? Or did the answer not provide the solution you were looking for? If it's the latter, please leave a comment for sundareshr for additional feedback.

[niketn]

Assuming Field is the field extracted by your search which contains both ComputerName and IPAddress values separated by newline character. You can use replace command to add your own delimeter (in the following example \n is replaced with #. Finally you can use split and mvindex command to read the two fields as needed.

<Your base Search> | eval Field= replace (Field,"\n","#") | eval Fields=split(Field,"#")| eval ComputerName=mvindex(Fields,0) | eval IPAddress=mvindex(Fields,1) | table Field ComputerName IPAddress

[ajdyer2000]

Hi,

I don't think I explained it the right way

I only have one field = Computer

Under Computer I have computer names and IP addresses

Computer1 [Carriage Return] 172.34.102.11
Computer2 [Carriage Return] 172.34.102.33
Computer3 [Carriage Return] 172.34.102.45
Computer4 [Carriage Return] 172.34.102.78
Computer5 [Carriage Return] 172.34.102.90

Need to create another field Called IP addresses

So now there will be 2 fields

Computer IPAddress

Computer1 172.34.102.11
Computer2 172.34.102.33
Computer3 172.34.102.45
Computer4 172.34.102.78
Computer5 172.34.102.90

So now there will be 2 fields
Computer

[niketn]

Can you add a screenshot of your Computer field. Seems like you have a multi-valued field where you can use all the even indexes for Computer and odd indexes for IP Addresses i.e.

eval Computer1=mvindex(Computer,0) | eval IPAddress1=mvindex(Computer,1) | eval Computer1=mvindex(Computer,2) | eval IPAddress1=mvindex(Computer,3) | ... 

Please let me know whether you want to do something like above, then you can use foreach to iterate through your records.

Also if the field is formed as multi-valued by your search query, you can also try to see if there is a feasibility to split them upfront rather than using mv commands.

[sundareshr]

Try this, assuming the field is called src

... | rex field=src "(?<ComputerName>[^\n]+)\n(?<IP>.*)" | table ComputerName IP

[gokadroid]

Can you please paste the exact events?