https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542334#M90621 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/64290">@bharat149</a>&nbsp;</P><P>Can you please try this?</P><LI-CODE lang="markup">YOUR_SEARCH | rex field=_raw "customerId (?&lt;customerId&gt;.*),\soperation\s(?&lt;operation&gt;.*),consumedUnits\s(?&lt;consumedUnits&gt;.*)" |table customerId operation consumedUnits</LI-CODE><P>&nbsp;</P><P>Sample Search</P><LI-CODE lang="markup">| makeresults | eval event="From abc customerId YETNAKCNK, operation create,consumedUnits 0|From abc customerId YETNAKCNJ, operation update,consumedUnits 2" | eval event=split(event,"|") | mvexpand event | rename event as _raw | rex field=_raw "customerId (?&lt;customerId&gt;.*),\soperation\s(?&lt;operation&gt;.*),consumedUnits\s(?&lt;consumedUnits&gt;.*)" |table customerId operation consumedUnits</LI-CODE> Thu, 04 Mar 2021 10:55:54 GMT kamlesh_vaghela 2021-03-04T10:55:54Z https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542333#M90620 <P>Hi All i have result in the below format :<BR /><SPAN>"From abc customerId YETNAKCNK, operation create,consumedUnits 0"<BR /></SPAN><SPAN>"From abc customerId YETNAKCNJ, operation update,consumedUnits 2"<BR /><BR />I have to convert the below data to the following format :&nbsp;<BR />customerId&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;operation&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;consumedUnits</SPAN></P><P><SPAN>YETNAKCNK.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;create&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0</SPAN></P><P><SPAN>YETNAKCNJ&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;update&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2</SPAN></P> Thu, 04 Mar 2021 10:49:53 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542333#M90620 bharat149 2021-03-04T10:49:53Z https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542334#M90621 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/64290">@bharat149</a>&nbsp;</P><P>Can you please try this?</P><LI-CODE lang="markup">YOUR_SEARCH | rex field=_raw "customerId (?&lt;customerId&gt;.*),\soperation\s(?&lt;operation&gt;.*),consumedUnits\s(?&lt;consumedUnits&gt;.*)" |table customerId operation consumedUnits</LI-CODE><P>&nbsp;</P><P>Sample Search</P><LI-CODE lang="markup">| makeresults | eval event="From abc customerId YETNAKCNK, operation create,consumedUnits 0|From abc customerId YETNAKCNJ, operation update,consumedUnits 2" | eval event=split(event,"|") | mvexpand event | rename event as _raw | rex field=_raw "customerId (?&lt;customerId&gt;.*),\soperation\s(?&lt;operation&gt;.*),consumedUnits\s(?&lt;consumedUnits&gt;.*)" |table customerId operation consumedUnits</LI-CODE> Thu, 04 Mar 2021 10:55:54 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542334#M90621 kamlesh_vaghela 2021-03-04T10:55:54Z https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542336#M90622 <P>and if i want to apply filter for the customer Id</P> Thu, 04 Mar 2021 11:17:02 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542336#M90622 bharat149 2021-03-04T11:17:02Z https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542337#M90623 <P>jus add<BR />| where customerId="YETNAKCNK"</P> Thu, 04 Mar 2021 11:20:41 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-a-string-to-table-in-splunk/m-p/542337#M90623 kamlesh_vaghela 2021-03-04T11:20:41Z