https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486212#M136041 <P>Thanks @to4kawa </P> Tue, 05 May 2020 04:48:59 GMT sarvesh_11 2020-05-05T04:48:59Z https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486208#M136037 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8791i4A7FBB036FF8512D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span>Hi Splunkers,<BR /> Please find attached image, this is the way i am getting my data.<BR /> My desired format is :</P> <P>Hostname | Microsoft .NET Framework 4.5.1 | Microsoft POS for .NET 1.12 | JAVA 8 Update 60 | UniversalForwarder | - -------<BR /> hostA | 4.5.50938 | 1.12.1296 | 8.0.600 | 7.2.5 | - -------</P> <P>My procedure is, to break the events with multikv and then use transpose.</P> <P>But multikv is not functioning as desired.</P> <P>TIA,</P> Mon, 04 May 2020 06:40:29 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486208#M136037 sarvesh_11 2020-05-04T06:40:29Z https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486209#M136038 <P>Hi</P> <P>Attachment is missing.</P> Mon, 04 May 2020 06:49:49 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486209#M136038 vnravikumar 2020-05-04T06:49:49Z https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486210#M136039 <P>hi @vnravikumar ,</P> <P>Updated</P> Mon, 04 May 2020 06:55:56 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486210#M136039 sarvesh_11 2020-05-04T06:55:56Z https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486211#M136040 <PRE><CODE>| rex mode=sed "s/\s\s+/,/g" | multikv forceheader=2 </CODE></PRE> <P>try this.</P> Mon, 04 May 2020 07:55:41 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486211#M136040 to4kawa 2020-05-04T07:55:41Z https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486212#M136041 <P>Thanks @to4kawa </P> Tue, 05 May 2020 04:48:59 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-break-events-using-multikv/m-p/486212#M136041 sarvesh_11 2020-05-05T04:48:59Z