https://community.splunk.com/t5/Getting-Data-In/How-to-expand-values-for-a-field-to-multiple-lines/m-p/130187#M26779 <P>You have to make it a <CODE>multivalued</CODE> field first:</P> <PRE><CODE>... | makemv delim=";" destination | mvexpand destination </CODE></PRE> Mon, 20 Jul 2015 13:52:17 GMT woodcock 2015-07-20T13:52:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-expand-values-for-a-field-to-multiple-lines/m-p/130186#M26778 <P>Hi, </P> <P>I have a field that I want to expand to multiple lines (it's email transactions), so I have a CSV of:</P> <P>source,destination<BR /> <A href="mailto:joe@x.com">joe@x.com</A>,<A href="mailto:jane@y.com">jane@y.com</A><BR /> <A href="mailto:joe@x.com">joe@x.com</A>,<A href="mailto:jane@y.com">jane@y.com</A>;<A href="mailto:bill@y.com">bill@y.com</A></P> <P>I want to expand this to 3 lines, which I think mvexpand should do, but it doesn't work and I can't figure out to tell it what the delimiter (";") is.</P> <P>Desired:<BR /> source,destination<BR /> <A href="mailto:joe@x.com">joe@x.com</A>,<A href="mailto:jane@y.com">jane@y.com</A><BR /> <A href="mailto:joe@x.com">joe@x.com</A>,<A href="mailto:jane@y.com">jane@y.com</A><BR /> <A href="mailto:joe@x.com">joe@x.com</A>,<A href="mailto:bill@y.com">bill@y.com</A></P> Mon, 20 Jul 2015 13:27:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-expand-values-for-a-field-to-multiple-lines/m-p/130186#M26778 adolan 2015-07-20T13:27:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-expand-values-for-a-field-to-multiple-lines/m-p/130187#M26779 <P>You have to make it a <CODE>multivalued</CODE> field first:</P> <PRE><CODE>... | makemv delim=";" destination | mvexpand destination </CODE></PRE> Mon, 20 Jul 2015 13:52:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-expand-values-for-a-field-to-multiple-lines/m-p/130187#M26779 woodcock 2015-07-20T13:52:17Z