https://community.splunk.com/t5/Getting-Data-In/Multiple-fields-from-json-array/m-p/331797#M93089 <P>Hi!<BR /> How to split JSON array elements (<EM>value</EM>)</P> <PRE><CODE>{ "id": 4321, "value": [ 5, 6, 7, 8 ] } </CODE></PRE> <P>from multivalue field:</P> <PRE><CODE>id | value 4321 5 6 7 8 </CODE></PRE> <P>to multiple fileds with some index remaining one event:</P> <PRE><CODE>id | value_0 | value_1 | value_2 | value_3 4321 5 6 7 8 </CODE></PRE> <P>Thank you!</P> Wed, 11 Apr 2018 13:30:13 GMT yurykiselev 2018-04-11T13:30:13Z https://community.splunk.com/t5/Getting-Data-In/Multiple-fields-from-json-array/m-p/331797#M93089 <P>Hi!<BR /> How to split JSON array elements (<EM>value</EM>)</P> <PRE><CODE>{ "id": 4321, "value": [ 5, 6, 7, 8 ] } </CODE></PRE> <P>from multivalue field:</P> <PRE><CODE>id | value 4321 5 6 7 8 </CODE></PRE> <P>to multiple fileds with some index remaining one event:</P> <PRE><CODE>id | value_0 | value_1 | value_2 | value_3 4321 5 6 7 8 </CODE></PRE> <P>Thank you!</P> Wed, 11 Apr 2018 13:30:13 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-fields-from-json-array/m-p/331797#M93089 yurykiselev 2018-04-11T13:30:13Z https://community.splunk.com/t5/Getting-Data-In/Multiple-fields-from-json-array/m-p/331798#M93090 <P>Can you try :</P> <PRE><CODE>| makemv delim=" " value | mvexpand value </CODE></PRE> Wed, 11 Apr 2018 13:33:34 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-fields-from-json-array/m-p/331798#M93090 p_gurav 2018-04-11T13:33:34Z