topic Re: How to separate events by using props/transforms? in Getting Data In

How to separate events by using props/transforms?

nonya_54 — Wed, 01 Apr 2026 16:39:04 GMT

I have logs that resemble the table below.

index=linux sourcetype=group | table group group_id, users

group	group_id	users
splunk	1	admin, john, jill
apache	2	sarah, bill

I would like the events to be separated by individual users so it looks like the table below. Is there a way to utilize transforms/props to separate the events by each different user?

index=linux sourcetype=group | table group group_id, users

group	group_id	users
splunk	1	admin
splunk	1	john
splunk	1	jill
apache	2	sarah
apache	2	bill

Re: How to separate events by using props/transforms?

VatsalJagani — Fri, 06 May 2022 17:53:41 GMT

@nonya_54 - Try:

index=linux sourcetype=group | table group group_id, users | makemv users delim="," | mvexpand users

I hope this helps!!!

Re: How to separate events by using props/transforms?

nonya_54 — Sun, 08 May 2022 16:39:42 GMT

Hello. Thank you for the response. I would like to be able to utilize the backend of Splunk as opposed to an inline search for the desired results.

Re: How to separate events by using props/transforms?

VatsalJagani — Sun, 08 May 2022 17:54:16 GMT

@nonya_54 - doing it from backend doesn't seem like a straight forward thing.

How you are collecting the data? If you are collecting it through script or something I would say you do it at that stage.

Doing it search time sounds still good as it will require less storage and license.

Re: How to separate events by using props/transforms?

PickleRick — Sun, 08 May 2022 20:41:36 GMT

You cannot do that. That's the short answer. There is no sane way of doing auch thing. When the event goes through the whole ingestion/indexing pipeline it is a single event. You can manipulate it, you can redirect it, you can extract fields, overwrite some parts of its data... But you can't split it into multiple events. You cant join multiple events into one either.