https://community.splunk.com/t5/Splunk-Search/split-filed-into-multiple-filed/m-p/557195#M158253 <P>The bit before the blank lines just sets up dummy data for the runanywhere example</P><LI-CODE lang="markup">| makeresults | eval X=split("ABC: YES, APPLICATION: DEF, ZONE: DATA, ENVIRONMENT: DEV|ZONE: INSIDE, ENVIRONMENT: PROD|ZONE: OUTSIDE, ENVIRONMENT: DEV, ABC: YES, APPLICATION: IJK","|") | mvexpand X | eval _raw=X | extract pairdelim="," kvdelim=":"</LI-CODE><P>&nbsp;</P> Fri, 25 Jun 2021 13:18:33 GMT ITWhisperer 2021-06-25T13:18:33Z https://community.splunk.com/t5/Splunk-Search/split-filed-into-multiple-filed/m-p/557182#M158248 <P>I would like to break "X" field into multiple field based on available value. "X" contain data in following format.&nbsp;</P><P>Field X-</P><P><SPAN>ABC: YES, APPLICATION: DEF, ZONE: DATA, ENVIRONMENT: DEV</SPAN></P><P><SPAN>ZONE: INSIDE, ENVIRONMENT: PROD</SPAN></P><P><SPAN>ZONE: OUTSIDE, ENVIRONMENT: DEV, ABC: YES, APPLICATION: IJK</SPAN></P><P><SPAN>=======</SPAN></P><P><SPAN>I would like the arrange data in following format.</SPAN></P><P>&nbsp;</P><P><SPAN>ABC&nbsp; &nbsp; &nbsp;APPLICATION&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ZONE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ENVIRONMENT</SPAN></P><P><SPAN>YES&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DEF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;DATA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;DEV</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;INSIDE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;PROD</SPAN></P><P><SPAN>YES&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IJK&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;OUTSIDE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DEV</SPAN></P><P>&nbsp;</P><P>TIA.&nbsp;</P><P>&nbsp;</P> Fri, 25 Jun 2021 12:11:38 GMT https://community.splunk.com/t5/Splunk-Search/split-filed-into-multiple-filed/m-p/557182#M158248 abhijeet 2021-06-25T12:11:38Z https://community.splunk.com/t5/Splunk-Search/split-filed-into-multiple-filed/m-p/557195#M158253 <P>The bit before the blank lines just sets up dummy data for the runanywhere example</P><LI-CODE lang="markup">| makeresults | eval X=split("ABC: YES, APPLICATION: DEF, ZONE: DATA, ENVIRONMENT: DEV|ZONE: INSIDE, ENVIRONMENT: PROD|ZONE: OUTSIDE, ENVIRONMENT: DEV, ABC: YES, APPLICATION: IJK","|") | mvexpand X | eval _raw=X | extract pairdelim="," kvdelim=":"</LI-CODE><P>&nbsp;</P> Fri, 25 Jun 2021 13:18:33 GMT https://community.splunk.com/t5/Splunk-Search/split-filed-into-multiple-filed/m-p/557195#M158253 ITWhisperer 2021-06-25T13:18:33Z https://community.splunk.com/t5/Splunk-Search/split-filed-into-multiple-filed/m-p/557575#M158354 <P>Thank you so much. Solution works...&nbsp;</P> Tue, 29 Jun 2021 10:22:13 GMT https://community.splunk.com/t5/Splunk-Search/split-filed-into-multiple-filed/m-p/557575#M158354 abhijeet 2021-06-29T10:22:13Z