topic Re: Help with rex- How do separate this event that came at the same time but different values? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Help-with-rex-How-do-separate-this-event-that-came-at-the-same/m-p/607816#M105501 <P>Use the mvexpand command to separate the values of the example A field into separate events.</P><LI-CODE lang="markup">| mvexpand 'example A'</LI-CODE> Mon, 01 Aug 2022 19:17:07 GMT richgalloway 2022-08-01T19:17:07Z Help with rex- How do separate this event that came at the same time but different values? https://community.splunk.com/t5/Getting-Data-In/Help-with-rex-How-do-separate-this-event-that-came-at-the-same/m-p/607814#M105499 <P>I have an event that came in the same time but have different data values that I need to separate.&nbsp;<BR /><BR />Example<BR /><BR /></P> <TABLE border="1" width="44.443129208754215%"> <TBODY> <TR> <TD width="33.333333333333336%" height="25px">_time</TD> <TD width="33.333333333333336%" height="25px">example A</TD> </TR> <TR> <TD width="33.333333333333336%" height="25px">2022-09-02</TD> <TD width="33.333333333333336%" height="25px">dgde746gdhu4<BR />duyheuye4d0</TD> </TR> </TBODY> </TABLE> <P><BR />I need this:</P> <TABLE border="1" width="44.443129208754215%"> <TBODY> <TR> <TD width="33.333333333333336%" height="25px">_time</TD> <TD width="33.333333333333336%" height="25px">example A</TD> </TR> <TR> <TD width="33.333333333333336%" height="25px">2022-09-02</TD> <TD width="33.333333333333336%" height="25px">dgde746gdhu4</TD> </TR> <TR> <TD height="25px">2022-09-02</TD> <TD height="25px">duyheuye4d0</TD> </TR> </TBODY> </TABLE> Mon, 01 Aug 2022 19:05:49 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-rex-How-do-separate-this-event-that-came-at-the-same/m-p/607814#M105499 Italy1358 2022-08-01T19:05:49Z Re: Help with rex- How do separate this event that came at the same time but different values? https://community.splunk.com/t5/Getting-Data-In/Help-with-rex-How-do-separate-this-event-that-came-at-the-same/m-p/607816#M105501 <P>Use the mvexpand command to separate the values of the example A field into separate events.</P><LI-CODE lang="markup">| mvexpand 'example A'</LI-CODE> Mon, 01 Aug 2022 19:17:07 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-rex-How-do-separate-this-event-that-came-at-the-same/m-p/607816#M105501 richgalloway 2022-08-01T19:17:07Z