https://community.splunk.com/t5/Splunk-Search/split-multi-value-fields/m-p/265103#M176865 <P>my dear friends,</P> <P>I'm running the below search string that give me the following result:<BR /> index=qualys IP="<EM>" DNS="</EM>" cve="*" | table IP DNS cve | dedup IP DNS cve</P> <P>result:<BR /> IP DNS cve<BR /> 10.252.64.84 horemedysso2v.alrajhi.bank CVE-2010-4094, CVE-2010-0557, CVE-2009-4189, CVE-2009-3548, CVE-2009-3099</P> <P>as you can see i have multi values in the cve filed seperated by comma.<BR /> my question is how to get the result to show as:<BR /> 10.252.64.84 horemedysso2v.alrajhi.bank CVE-2010-4094<BR /> 10.252.64.84 horemedysso2v.alrajhi.bank CVE-2010-0557<BR /> 10.252.64.84 horemedysso2v.alrajhi.bank CVE-2009-4189<BR /> etc ...<BR /> meaning the i want the IP and DNS filed to be repeated with each single value of cve field and each one will be in new row.</P> <P>thanks in advance</P> Sun, 04 Sep 2016 05:16:10 GMT aliroumani 2016-09-04T05:16:10Z https://community.splunk.com/t5/Splunk-Search/split-multi-value-fields/m-p/265103#M176865 <P>my dear friends,</P> <P>I'm running the below search string that give me the following result:<BR /> index=qualys IP="<EM>" DNS="</EM>" cve="*" | table IP DNS cve | dedup IP DNS cve</P> <P>result:<BR /> IP DNS cve<BR /> 10.252.64.84 horemedysso2v.alrajhi.bank CVE-2010-4094, CVE-2010-0557, CVE-2009-4189, CVE-2009-3548, CVE-2009-3099</P> <P>as you can see i have multi values in the cve filed seperated by comma.<BR /> my question is how to get the result to show as:<BR /> 10.252.64.84 horemedysso2v.alrajhi.bank CVE-2010-4094<BR /> 10.252.64.84 horemedysso2v.alrajhi.bank CVE-2010-0557<BR /> 10.252.64.84 horemedysso2v.alrajhi.bank CVE-2009-4189<BR /> etc ...<BR /> meaning the i want the IP and DNS filed to be repeated with each single value of cve field and each one will be in new row.</P> <P>thanks in advance</P> Sun, 04 Sep 2016 05:16:10 GMT https://community.splunk.com/t5/Splunk-Search/split-multi-value-fields/m-p/265103#M176865 aliroumani 2016-09-04T05:16:10Z https://community.splunk.com/t5/Splunk-Search/split-multi-value-fields/m-p/265104#M176866 <P>Try this.</P> <PRE><CODE>index=qualys IP="" DNS="" cve="*" | table IP DNS cve | makemv cve delim="," | mvexpand cve | dedup IP DNS cve </CODE></PRE> Sun, 04 Sep 2016 16:05:24 GMT https://community.splunk.com/t5/Splunk-Search/split-multi-value-fields/m-p/265104#M176866 sundareshr 2016-09-04T16:05:24Z https://community.splunk.com/t5/Splunk-Search/split-multi-value-fields/m-p/265105#M176867 <P>perfecttttttttttttttttttttttttttttttttttttttt ...<BR /> thank you so much my friend.</P> Mon, 05 Sep 2016 05:04:22 GMT https://community.splunk.com/t5/Splunk-Search/split-multi-value-fields/m-p/265105#M176867 aliroumani 2016-09-05T05:04:22Z