<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How  to split values that appear in one row? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493847#M84366</link>
    <description>&lt;P&gt;You can use &lt;CODE&gt;table&lt;/CODE&gt; command with the required column at the end&lt;/P&gt;</description>
    <pubDate>Tue, 12 May 2020 13:42:18 GMT</pubDate>
    <dc:creator>vnravikumar</dc:creator>
    <dc:date>2020-05-12T13:42:18Z</dc:date>
    <item>
      <title>How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493838#M84357</link>
      <description>&lt;P&gt;I have search querrie created from json file. Problem is values that i have appear in one row, instead of 3 rows(in json file we have three ids with number and status).  Thanks in advance!!&lt;BR /&gt;
&lt;A href="https://answers.splunk.comstorage/temp/291753-1.png"&gt;alt text&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 12:07:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493838#M84357</guid>
      <dc:creator>ikoniasavina</dc:creator>
      <dc:date>2020-05-12T12:07:52Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493839#M84358</link>
      <description>&lt;P&gt;use &lt;CODE&gt;mvzip&lt;/CODE&gt; to three fields. and  &lt;CODE&gt;mvexpand&lt;/CODE&gt; and re-extract them.&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 12:36:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493839#M84358</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-05-12T12:36:50Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493840#M84359</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;

&lt;P&gt;Try this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval id="02,03,01" 
| makemv delim="," id 
| appendcols 
    [| makeresults 
    | eval Number="30,20,40" 
    | makemv delim="," Number] 
| appendcols 
    [| makeresults 
    | eval Status="In progress,In Progress,To Do" 
    | makemv delim="," Status] 
| fields - _time 
| eval temp=mvzip(mvzip(id,Number),Status) 
| fields temp 
| mvexpand temp 
| eval temp_value=split(temp,",") 
| eval id=mvindex(temp_value,0), Number=mvindex(temp_value,1), Status=mvindex(temp_value,2) 
| table id Number Status
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 12 May 2020 12:39:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493840#M84359</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2020-05-12T12:39:53Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493841#M84360</link>
      <description>&lt;P&gt;Thanks. This looks great! But it should be done without given values.&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 13:05:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493841#M84360</guid>
      <dc:creator>ikoniasavina</dc:creator>
      <dc:date>2020-05-12T13:05:46Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493842#M84361</link>
      <description>&lt;P&gt;Can you show me on example querry&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 13:06:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493842#M84361</guid>
      <dc:creator>ikoniasavina</dc:creator>
      <dc:date>2020-05-12T13:06:33Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493843#M84362</link>
      <description>&lt;P&gt;what's your query?&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 13:09:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493843#M84362</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-05-12T13:09:40Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493844#M84363</link>
      <description>&lt;P&gt;yes.&lt;BR /&gt;
 source="jsonfile" |rename customfield_1 AS id, customfield_2 AS Status, customfield_3 AS Number | eval data=mvzip(id,Number,Status)| mvexpand data| makemv data delim=","| eval id=mvindex(data,0),Number=mvindex(data,1), Status=mvindex(data,2)| fields - data&lt;/P&gt;</description>
      <pubDate>Wed, 30 Sep 2020 05:21:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493844#M84363</guid>
      <dc:creator>ikoniasavina</dc:creator>
      <dc:date>2020-09-30T05:21:37Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493845#M84364</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;

&lt;P&gt;Try this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="jsonfile" 
| rename customfield_1 AS id, customfield_2 AS Status, customfield_3 AS Number 
| eval data=mvzip(mvzip(id,Number),Status) 
| mvexpand data 
| makemv data delim="," 
| eval id=mvindex(data,0),Number=mvindex(data,1), Status=mvindex(data,2) 
| fields - data
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 12 May 2020 13:21:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493845#M84364</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2020-05-12T13:21:49Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493846#M84365</link>
      <description>&lt;P&gt;This is great!!They are separated now with their values. Is it possible to make a table only from those three: id, number and label. because a result returns also other fields. could you help me with that?&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 13:29:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493846#M84365</guid>
      <dc:creator>ikoniasavina</dc:creator>
      <dc:date>2020-05-12T13:29:52Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493847#M84366</link>
      <description>&lt;P&gt;You can use &lt;CODE&gt;table&lt;/CODE&gt; command with the required column at the end&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 13:42:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493847#M84366</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2020-05-12T13:42:18Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493848#M84367</link>
      <description>&lt;P&gt;&lt;STRONG&gt;Great! Thank You very much!&lt;/STRONG&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 13:48:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493848#M84367</guid>
      <dc:creator>ikoniasavina</dc:creator>
      <dc:date>2020-05-12T13:48:21Z</dc:date>
    </item>
    <item>
      <title>Re: How  to split values that appear in one row?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493849#M84368</link>
      <description>&lt;P&gt;Please accept the answer.&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 13:52:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-values-that-appear-in-one-row/m-p/493849#M84368</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2020-05-12T13:52:38Z</dc:date>
    </item>
  </channel>
</rss>

