https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-into-multiple-events-based-on-field-a/m-p/378170#M68398 <P>Hi All,<BR /> In search head for a single event I can see below kind of data (single event)</P> <P>tag field1="123" field2="abc" field3="yes"<BR /> /tag<BR /> <STRONG>Sometext</STRONG><BR /> tag field1="766" field2="hjh" field3="no" <BR /> /tag<BR /> <STRONG>Sometext</STRONG><BR /> tag field1="103" field2="anc" field3="yes"<BR /> /tag<BR /> <STRONG>Sometext</STRONG></P> <P>In search head I can able to see field1 as a field but the values in that are storing randomly (above kind f events are there)<BR /> How to split the single event into multiple events based on string or field in above ?</P> Wed, 19 Dec 2018 17:23:39 GMT raj_mpl 2018-12-19T17:23:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-into-multiple-events-based-on-field-a/m-p/378170#M68398 <P>Hi All,<BR /> In search head for a single event I can see below kind of data (single event)</P> <P>tag field1="123" field2="abc" field3="yes"<BR /> /tag<BR /> <STRONG>Sometext</STRONG><BR /> tag field1="766" field2="hjh" field3="no" <BR /> /tag<BR /> <STRONG>Sometext</STRONG><BR /> tag field1="103" field2="anc" field3="yes"<BR /> /tag<BR /> <STRONG>Sometext</STRONG></P> <P>In search head I can able to see field1 as a field but the values in that are storing randomly (above kind f events are there)<BR /> How to split the single event into multiple events based on string or field in above ?</P> Wed, 19 Dec 2018 17:23:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-into-multiple-events-based-on-field-a/m-p/378170#M68398 raj_mpl 2018-12-19T17:23:39Z