Splunk Search

How to break up a single string value in an existing field into a new (multivalued) field with a list of separate values?

ashishlal82
Explorer

I have a field name hosts which has values as:

10.128.193.39,10.128.193.52,10.128.193.47,10.128.193.55,10.128.193.40,10.128.193.49,10.128.193.42,10.128.193.41,10.128.193.37

What functionality within Splunk I can use to strip these addresses and create a new field with a list of all these as separate values rather than just one value that holds all of them? Not sure if I have to use regex?

Output
10.128.193.39
10.128.193.52
10.128.193.47

Tags (2)
0 Karma

sundareshr
Legend

Try this (skip the mvexpand if you want to keep is mv)

... | makemv hosts delim="," | mvexpand hosts
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...