Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I parse one large comma-delimited field into multiple fields with numbered names?

$
0
0
I have an event that looks similar to the following: 2017-10-18 16:59:30.943, MetaDataFoo="ValueFoo", Event_Time="2017-10-18 16:59:30.943", Measurement="45.89502,44.895,44.99505,44.89502,44.89502,45.42877,45.96756,46.09344,46.22437,46.315" I am trying to parse the "Measurement" field values into separate fields per value. For example: Measurement="45.89502,44.895,44.99505,44.89502,44.89502,45.42877,45.96756,46.09344,46.22437,46.315" Turns Into the following fields: Measurement_0 = 45.89502 Measurement_1 = 44.895 Measurement_2 = 44.99505 Measurement_3 = 44.89502 etc... I feel like this could be done with **eval** and **mvindex**, but I really don't want to write an eval for each new value since my actual dataset has 1024 values in the Measurement field. Any help would be much appreciated.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>