topic Re: How do I delimit multivalue fields? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357193#M105673 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/43409">@anil_ec21</a>, please accept kamlesh_vaghela's answer if this helped.</P> Tue, 29 Sep 2020 16:40:32 GMT niketn 2020-09-29T16:40:32Z How do I delimit multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357189#M105669 <P>Dear All,</P> <P>We have a scenario, where For each <EM>Application_ID</EM>, <EM>Application_Name</EM> is having multi-value and delimited. </P> <P>we would like the data loaded into individual rows, in the following manner - </P> <P>Example: <EM>Application_Name</EM> is multi-value and delimited (A:B:C)</P> <P>Application_ID Application_Name<BR /> 1 A:B:C<BR /> 2 D:E:F</P> <P>Desired Output:</P> <P>Row 1: 1 A<BR /> Row 2: 1 B<BR /> Row 3: 1 C<BR /> Row 4: 2 D<BR /> Row 5: 2 E<BR /> Row 6: 2 F</P> <P>How do I accomplish this? </P> <P>Thanks in Advance<BR /> Anil</P> Tue, 29 Sep 2020 16:40:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357189#M105669 anil_ec21 2020-09-29T16:40:23Z Re: How do I delimit multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357190#M105670 <P>Hi </P> <P>Can you please try this search?/</P> <PRE><CODE>YOUR SEARCH | makemv delim=: Application_Name | mvexpand Application_Name </CODE></PRE> <P>Thanks</P> Wed, 08 Nov 2017 18:28:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357190#M105670 kamlesh_vaghela 2017-11-08T18:28:04Z Re: How do I delimit multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357191#M105671 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/43409">@anil_ec21</a></P> <P>try this</P> <P>| makeresults <BR /> | eval Application_ID="1;2" <BR /> | eval Application_Name="A:B:C;D:E:F" <BR /> | eval Application_ID=split(Application_ID,";") <BR /> | eval Application_Name = split(Application_Name,";") <BR /> | eval test=mvzip(Application_ID,Application_Name) <BR /> | mvexpand test <BR /> | fields test<BR /> | rex field=test max_match=0 "(?P&lt;v2&gt;\d+),(?P&lt;v2&gt;\S+)" <BR /> | eval v2=split(v2,":") <BR /> | mvexpand v2 <BR /> | rename v1 as Application_ID, v2 as Application_Name <BR /> | table Application_ID Application_Name </P> Tue, 29 Sep 2020 16:40:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357191#M105671 sbbadri 2020-09-29T16:40:26Z Re: How do I delimit multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357192#M105672 <P>Thanks for the quick reply Kamlesh. Your query worked. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 08 Nov 2017 19:17:02 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357192#M105672 anil_ec21 2017-11-08T19:17:02Z Re: How do I delimit multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357193#M105673 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/43409">@anil_ec21</a>, please accept kamlesh_vaghela's answer if this helped.</P> Tue, 29 Sep 2020 16:40:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-delimit-multivalue-fields/m-p/357193#M105673 niketn 2020-09-29T16:40:32Z