https://community.splunk.com/t5/Splunk-Search/Split-a-field/m-p/541808#M153425 <P>Hi,</P><P>I have 4 different correlation ID's in same row, I want to split them and place it in single row</P><P>1aaaaa-2bbbb-3cccc-4dddd 5aaaa-6bbb-7ccc-8ddd&nbsp;1eeee-2ffb-3cggc-4dhhd 5aiia-6jjb-7kkc-8lld</P><P>&nbsp;</P> Mon, 01 Mar 2021 16:08:35 GMT VijaySrrie 2021-03-01T16:08:35Z https://community.splunk.com/t5/Splunk-Search/Split-a-field/m-p/541808#M153425 <P>Hi,</P><P>I have 4 different correlation ID's in same row, I want to split them and place it in single row</P><P>1aaaaa-2bbbb-3cccc-4dddd 5aaaa-6bbb-7ccc-8ddd&nbsp;1eeee-2ffb-3cggc-4dhhd 5aiia-6jjb-7kkc-8lld</P><P>&nbsp;</P> Mon, 01 Mar 2021 16:08:35 GMT https://community.splunk.com/t5/Splunk-Search/Split-a-field/m-p/541808#M153425 VijaySrrie 2021-03-01T16:08:35Z https://community.splunk.com/t5/Splunk-Search/Split-a-field/m-p/541811#M153426 <P>It looks like you need to split by " " to create a multi-value field, then mvexpand the field to put them on separate rows.</P> Mon, 01 Mar 2021 16:16:04 GMT https://community.splunk.com/t5/Splunk-Search/Split-a-field/m-p/541811#M153426 ITWhisperer 2021-03-01T16:16:04Z