Splunk input
Description
This transform allows you to split a row containing a delimited field into multiple new rows, one per split value. The original row is not delivered to following transforms. The original field is left in each new row to assist in debugging or error handling. It can be removed via a Select Values transform if needed.
The original field must be a string field. A new field name must be specified. If the value type/format of the new row is not specified, the new field will use the same type/format as the original field.
Options
Option | Description |
---|---|
Transform name | Name of the transform. |
Field to split | The field you want to split |
Delimiter | The delimiter or separator used. Special characters (e.g. CHAR ASCII HEX01) can be set with the format $[value], e.g. $[01] or $[6F,FF,00,1F]. |
New name field | The name of the new field |