topic Re: How do I split an event with extracted fields into rows? in Splunk Search

How do I split an event with extracted fields into rows?

shaheelkhan59 — Fri, 12 Oct 2018 11:43:23 GMT

Hello all,

I've used the following SPL to extract some fields from my logs.

I got the following result.

My issue is that each row in pic2 is not in separate rows. They are a part of an event. I want each row in Pic2 as separate rows. How this can be done?

i've tried mvexpand, but I didn't get the required format.

Re: How do I split an event with extracted fields into rows?

richgalloway — Fri, 12 Oct 2018 12:42:40 GMT

The mvexpand command is the answer, but it's a little tricky because you have several multi-value fields. See Example 3 in the mvexpand docs at http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Mvexpand#Examples.

Re: How do I split an event with extracted fields into rows?

shaheelkhan59 — Fri, 12 Oct 2018 13:25:33 GMT

Thanks richgalloway it worked perfect. Thanks again for quick response. Following pics shows what I changedalt text

Re: How do I split an event with extracted fields into rows?

shaheelkhan59 — Fri, 12 Oct 2018 13:30:46 GMT

I did this. It also worked perfectly