https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497128#M84753 <P>Hello,</P> <P>I have a fields in my index named MESSAGE. </P> <PRE><CODE>[BBB] ProcessGenererIdentifiantLMKRImpl/genererIdentifiantLMKR - CHECK OK - codeClient= 98451635- codeCanal= III- identifiantLMKR= JHF7UNJK6ZJNEZFI0873NFI373UBF389, nomMethode=genererIdentifiantLMKR </CODE></PRE> <P>The result that i want is </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8298i5D1013F73FF6C07D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 28 Jan 2020 13:48:22 GMT tahasefiani 2020-01-28T13:48:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497128#M84753 <P>Hello,</P> <P>I have a fields in my index named MESSAGE. </P> <PRE><CODE>[BBB] ProcessGenererIdentifiantLMKRImpl/genererIdentifiantLMKR - CHECK OK - codeClient= 98451635- codeCanal= III- identifiantLMKR= JHF7UNJK6ZJNEZFI0873NFI373UBF389, nomMethode=genererIdentifiantLMKR </CODE></PRE> <P>The result that i want is </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8298i5D1013F73FF6C07D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 28 Jan 2020 13:48:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497128#M84753 tahasefiani 2020-01-28T13:48:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497129#M84754 <PRE><CODE>| makeresults | eval message="[BBB] ProcessGenererIdentifiantLMKRImpl/genererIdentifiantLMKR - CHECK OK - codeClient= 98451635- codeCanal= III- identifiantLMKR= JHF7UNJK6ZJNEZFI0873NFI373UBF389, nomMethode=genererIdentifiantLMKR" | eval _raw=split(replace(replace(message," ",""),",","-"),"-") | kv | table codeClient identifiantLMKR </CODE></PRE> Tue, 28 Jan 2020 14:04:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497129#M84754 to4kawa 2020-01-28T14:04:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497130#M84755 <P>@tahasefiani </P> <P>Can you please try this?</P> <PRE><CODE>YOUR_SEARCH | rex field=MESSAGE "codeClient=\s(?&lt;codeClient&gt;\d+[^-]).*identifiantLMKR=\s(?&lt;identifiantLMKR&gt;\w+)" | table codeClient identifiantLMKR </CODE></PRE> <P><STRONG>Sample search:</STRONG></P> <PRE><CODE>| makeresults | eval MESSAGE="[BBB] ProcessGenererIdentifiantLMKRImpl/genererIdentifiantLMKR - CHECK OK - codeClient= 98451635- codeCanal= III- identifiantLMKR= JHF7UNJK6ZJNEZFI0873NFI373UBF389, nomMethode=genererIdentifiantLMKR" | rex field=MESSAGE "codeClient=\s(?&lt;codeClient&gt;\d+[^-]).*identifiantLMKR=\s(?&lt;identifiantLMKR&gt;\w+)" | table codeClient identifiantLMKR </CODE></PRE> Tue, 28 Jan 2020 14:08:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497130#M84755 kamlesh_vaghela 2020-01-28T14:08:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497131#M84756 <P>it returns me empty columns</P> Wed, 29 Jan 2020 09:14:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-String-sentence-into-one-row/m-p/497131#M84756 tahasefiani 2020-01-29T09:14:08Z