https://community.splunk.com/t5/Splunk-Dev/json-data-breaking-output-to-values/m-p/399632#M6874 <P>We have events in json, and one of the fields is called output.</P> <P>sample data from the output field looks like this:</P> <P>output:<BR /><BR /> Intel Manageability Firmware : 11.0.16.1000<BR /> Fixed Firmware : 11.0.25.3001</P> <P>I need the values for the output field broken into two values. Not sure how to do this?</P> Tue, 15 Jan 2019 21:37:13 GMT mcbradford 2019-01-15T21:37:13Z https://community.splunk.com/t5/Splunk-Dev/json-data-breaking-output-to-values/m-p/399632#M6874 <P>We have events in json, and one of the fields is called output.</P> <P>sample data from the output field looks like this:</P> <P>output:<BR /><BR /> Intel Manageability Firmware : 11.0.16.1000<BR /> Fixed Firmware : 11.0.25.3001</P> <P>I need the values for the output field broken into two values. Not sure how to do this?</P> Tue, 15 Jan 2019 21:37:13 GMT https://community.splunk.com/t5/Splunk-Dev/json-data-breaking-output-to-values/m-p/399632#M6874 mcbradford 2019-01-15T21:37:13Z https://community.splunk.com/t5/Splunk-Dev/json-data-breaking-output-to-values/m-p/399633#M6875 <P>@mcbradford </P> <P>Can you please share full event with sample data? Also share expected output from sample event.. </P> Wed, 16 Jan 2019 13:12:26 GMT https://community.splunk.com/t5/Splunk-Dev/json-data-breaking-output-to-values/m-p/399633#M6875 kamlesh_vaghela 2019-01-16T13:12:26Z