Seperate Multivalue Fields with Carriage Return Delimiter

mistydennis — Fri, 08 Jun 2018 15:39:34 GMT

Hi all - I have data that appears like this:

Field=Animal
Cat
Dog
Fish

Dog
Fish

Horse
Cat
Dog
Pig

.....where multiple values are populating one cell, all separated by a carriage return. There are not the same number of values in each cell, sometimes 1, sometimes 5. I know how to separate these out when there is a comma or a semicolon used as a delimiter, but how do I separate these kind of values that have no visible delimiter?

Re: Seperate Multivalue Fields with Carriage Return Delimiter

493669 — Sat, 09 Jun 2018 04:51:05 GMT

Hi @mistydennis,
Use mvexpand command to separate multivalue fields:

...|mvexpand Animal

Reference: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Mvexpand

topic Re: Seperate Multivalue Fields with Carriage Return Delimiter in Splunk Search

Seperate Multivalue Fields with Carriage Return Delimiter

Re: Seperate Multivalue Fields with Carriage Return Delimiter