https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481689#M134990 <P>hi,</P> <P>thank you for your answer. <BR /> It doesn't work unfortunately. The result is the same with the full list of KPITilte and one line of ServiceTitle. </P> <P>I also try something with mvzip and mvindex, I return with wrong code. <BR /> | inputlookup service_kpi_lookup<BR /> | eval field=mvzip(mvzip(kpis._key,kpis.tilte),sec_grp)<BR /> | stats count by title field <BR /> | eval kpis_key=mvindex(split(field,","),0), KPITitle=mvindex(split(field,",")1)</P> Wed, 30 Sep 2020 02:11:51 GMT htramtran83 2020-09-30T02:11:51Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481687#M134988 <PRE><CODE>ServiceTitle KPITitle kpis_key SmartCas ServiceHealthScore SHKPI-17c3399b-d559-4e91 CPU Utilization: % 793faace-3431-4d54-a54c-f07fbb520425 IOWait % 9e984025-b4ba-43c1-a165 Storage Operations: Latency 3d063082-9fe2-48f4 GC-Major Collection Time Spent Per Min : 33a4d376ed6e7d5aa0be31b1 </CODE></PRE> <P>The search I run is :</P> <PRE><CODE>| inputlookup service_kpi_lookup| rename title as ServiceTitle kpis.title as KPITitle | fields ServiceTitle, KPITitle, kpis_key </CODE></PRE> <P>How can I run each of line of service name is same row of KPI title and kpi key (it doesn't matter if duplicate)</P> <P>thank you.</P> Mon, 16 Sep 2019 17:53:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481687#M134988 htramtran83 2019-09-16T17:53:05Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481688#M134989 <P>Try</P> <PRE><CODE>| inputlookup service_kpi_lookup| rename title as ServiceTitle kpis.title as KPITitle | filldown ServiceTitle | fields ServiceTitle, KPITitle, kpis_key </CODE></PRE> Mon, 16 Sep 2019 19:58:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481688#M134989 richgalloway 2019-09-16T19:58:44Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481689#M134990 <P>hi,</P> <P>thank you for your answer. <BR /> It doesn't work unfortunately. The result is the same with the full list of KPITilte and one line of ServiceTitle. </P> <P>I also try something with mvzip and mvindex, I return with wrong code. <BR /> | inputlookup service_kpi_lookup<BR /> | eval field=mvzip(mvzip(kpis._key,kpis.tilte),sec_grp)<BR /> | stats count by title field <BR /> | eval kpis_key=mvindex(split(field,","),0), KPITitle=mvindex(split(field,",")1)</P> Wed, 30 Sep 2020 02:11:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481689#M134990 htramtran83 2020-09-30T02:11:51Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481690#M134991 <P>Please share the format of your CSV file.</P> Tue, 17 Sep 2019 18:11:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481690#M134991 richgalloway 2019-09-17T18:11:47Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481691#M134992 <P>I have my own answer, <BR /> I used the query with mvzip and mvindex:<BR /> my search<BR /> | eval kpis_info = mvzip(mvzip(mvzip(kpis_<EM>key, kpis_base_search, "==@@=="), kpis_search_type, "==@@=="), kpis_title, "==@@==")<BR /> | mvexpand kpis_info<BR /> | eval kpis_info=split(kpis_info, "==@@==")<BR /> | eval kpis_base_search=mvindex(kpis_info, 1)<BR /> | eval kpis</EM>_key=mvindex(kpis_info,0)<BR /> | eval kpis_title=mvindex(kpis_info,3)<BR /> | eval kpis_search_type=mvindex(kpis_info,2)</P> Wed, 30 Sep 2020 02:13:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481691#M134992 htramtran83 2020-09-30T02:13:19Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481692#M134993 <P>I have my own solution with :<BR /> my search...<BR /> | eval kpis_info = mvzip(mvzip(mvzip(kpis_<EM>key, kpis_base_search, "==@@=="), kpis_search_type, "==@@=="), kpis_title, "==@@==")<BR /> | mvexpand kpis_info<BR /> | eval kpis_info=split(kpis_info, "==@@==")<BR /> | eval kpis_base_search=mvindex(kpis_info, 1)<BR /> | eval kpis</EM>_key=mvindex(kpis_info,0)<BR /> | eval kpis_title=mvindex(kpis_info,3)<BR /> | eval kpis_search_type=mvindex(kpis_info,2)</P> Wed, 30 Sep 2020 02:13:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-each-line-and-data-row/m-p/481692#M134993 htramtran83 2020-09-30T02:13:22Z