This example shows how you can split data from a single column into multiple columns using the following types of delimiters:
- single-pattern delimiter: One pattern is applied one or more times to the source column to define the delimiters for the output columns
- multi-pattern delimiter: Multiple patterns, in the form of explicit strings, character index positions, or fixed-width fields, are used to split the column.
For more information on these methods, see Split Transform.
In this example, your CSV dataset contains status messages from servers in your environment. In this case, the data about the server and the timestamp is contained in a single value within the CSV.
Server|Date Time,Status admin.examplecom|2016-03-05 07:04:00,down webapp.examplecom|2016-03-05 07:04:00,ok admin.examplecom|2016-03-05 07:04:30,rebooting webapp.examplecom|2016-03-05 07:04:00,ok admin.examplecom|2016-03-05 07:05:00,ok webapp.examplecom|2016-03-05 07:05:00,ok
When the data is first loaded into the Transformer page, the CSV data is split using the following two transforms:
splitrows col: column1 on: '\r'
You might need to add a
split col: column1 on: ',' quote: '\"'
headeras the first step:
At this point, your data should look like the following:
The first column contains three distinct sets of data: the server name, the date, and the time. Note that the delimiters between these fields are different, so you should use a multi-pattern delimiter to break them apart:
When the above is added, you should see three separate columns with the individual fields of information. Note that the source column has been automatically dropped.
split col:Server_Date_Time delimiters:'|',' '
NOTE: A column name cannot contain the
| value, so the source column name cannot be used as the basis for the column names applied to the generated columns. In this case, you must use the
rename transform to update the generated columns accordingly.
Now, you decide that it would be useful to break apart the timestamp column into separate columns for year, month, and day. Since the column delimiter of this field is consistently a dash (
-), you can use a single-pattern delimiter with the
split col:date on:`-` limit:2
After you rename the generated columns, your dataset should look like the following. Note that the source timestamp column has been automatically dropped.