topic Re: How to split a table-formatted event into multiple events during search time? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-split-a-table-formatted-event-into-multiple-events-during/m-p/371641#M109369 <P>To split a table-formatted event into multipe events during search time, you can use the <A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Multikv">multikv</A> command.</P> <P>Try it like this:</P> <PRE><CODE>your search | multikv </CODE></PRE> <P>You should get an event for each line. Each event should have the fields NAME, VERSION, RELEASE etc.</P> Fri, 09 Feb 2018 12:03:41 GMT Yunagi 2018-02-09T12:03:41Z How to split a table-formatted event into multiple events during search time? https://community.splunk.com/t5/Splunk-Search/How-to-split-a-table-formatted-event-into-multiple-events-during/m-p/371640#M109368 <P>Is it possible to have each piece of software as an event of its own so that I could search for a particular item?</P> <P>Could some cool regex break this up into searchable data?</P> <P>Desired output in screenshot below</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4363iFF37BF418EC09540/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 09 Feb 2018 11:35:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-a-table-formatted-event-into-multiple-events-during/m-p/371640#M109368 davidcraven02 2018-02-09T11:35:31Z Re: How to split a table-formatted event into multiple events during search time? https://community.splunk.com/t5/Splunk-Search/How-to-split-a-table-formatted-event-into-multiple-events-during/m-p/371641#M109369 <P>To split a table-formatted event into multipe events during search time, you can use the <A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Multikv">multikv</A> command.</P> <P>Try it like this:</P> <PRE><CODE>your search | multikv </CODE></PRE> <P>You should get an event for each line. Each event should have the fields NAME, VERSION, RELEASE etc.</P> Fri, 09 Feb 2018 12:03:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-a-table-formatted-event-into-multiple-events-during/m-p/371641#M109369 Yunagi 2018-02-09T12:03:41Z Re: How to split a table-formatted event into multiple events during search time? https://community.splunk.com/t5/Splunk-Search/How-to-split-a-table-formatted-event-into-multiple-events-during/m-p/371642#M109370 <P>Thank you so much</P> Fri, 09 Feb 2018 12:38:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-a-table-formatted-event-into-multiple-events-during/m-p/371642#M109370 davidcraven02 2018-02-09T12:38:22Z