https://community.splunk.com/t5/Splunk-Search/Field-extraction-in-tabular-format-data/m-p/72943#M18260 <P>Hi ,<BR /> I have events in following format<BR /> Subject Maths English Science <BR /> Marks1 95 98 96<BR /> Marks2 9 8 10</P> <P>I want to extract subject name and marks2 value and display in an tabular format for all the events.<BR /> How can this be achieved.<BR /> Output table expected is<BR /> "Timestamp of event" Maths English Science<BR /> 25-12-2012 9 8 10</P> <P>Thank you</P> Tue, 25 Dec 2012 11:14:29 GMT splunk_learner 2012-12-25T11:14:29Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-in-tabular-format-data/m-p/72943#M18260 <P>Hi ,<BR /> I have events in following format<BR /> Subject Maths English Science <BR /> Marks1 95 98 96<BR /> Marks2 9 8 10</P> <P>I want to extract subject name and marks2 value and display in an tabular format for all the events.<BR /> How can this be achieved.<BR /> Output table expected is<BR /> "Timestamp of event" Maths English Science<BR /> 25-12-2012 9 8 10</P> <P>Thank you</P> Tue, 25 Dec 2012 11:14:29 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-in-tabular-format-data/m-p/72943#M18260 splunk_learner 2012-12-25T11:14:29Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-in-tabular-format-data/m-p/72944#M18261 <P>You should be able to use <CODE>multikv</CODE> for this.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv</A></P> Tue, 25 Dec 2012 11:18:38 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-in-tabular-format-data/m-p/72944#M18261 Ayn 2012-12-25T11:18:38Z https://community.splunk.com/t5/Splunk-Search/Field-extraction-in-tabular-format-data/m-p/72945#M18262 <P>Thanks .This was what i wanted.</P> Wed, 26 Dec 2012 06:10:53 GMT https://community.splunk.com/t5/Splunk-Search/Field-extraction-in-tabular-format-data/m-p/72945#M18262 splunk_learner 2012-12-26T06:10:53Z