topic Re: Separate the fields from a merged result in Splunk Search https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481571#M193096 <P>Thanks , I was able to get two separate fields based on the Status using the eval command.</P> Tue, 21 Apr 2020 21:19:11 GMT s_kandula 2020-04-21T21:19:11Z Separate the fields from a merged result https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481569#M193094 <P>Hi </P> <P>I have two events with following fields<BR /> Event 1<BR /> Log.Status : IN<BR /> TransactionTime : IN time<BR /> Tracking id: Unique ID (common between Event 1 and 2)</P> <P>Event 2<BR /> Log.Status :OUT<BR /> TransactionTime: OUTtime<BR /> Trackingid</P> <P>I merged the events using tracking ID and i got the required fields. But under transactionTime, I am seeing two times (IN and OUT) one below the other. Is there a way to list the times as separate fields in the merge results. </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8750i621A560BFC370BF4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 21 Apr 2020 20:03:24 GMT https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481569#M193094 s_kandula 2020-04-21T20:03:24Z Re: Separate the fields from a merged result https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481570#M193095 <P>use <CODE>mvindex</CODE> in <CODE>eval</CODE></P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval</A></P> Tue, 21 Apr 2020 21:11:13 GMT https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481570#M193095 to4kawa 2020-04-21T21:11:13Z Re: Separate the fields from a merged result https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481571#M193096 <P>Thanks , I was able to get two separate fields based on the Status using the eval command.</P> Tue, 21 Apr 2020 21:19:11 GMT https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481571#M193096 s_kandula 2020-04-21T21:19:11Z Re: Separate the fields from a merged result https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481572#M193097 <P>I see, please accept my answer.</P> Tue, 21 Apr 2020 21:47:38 GMT https://community.splunk.com/t5/Splunk-Search/Separate-the-fields-from-a-merged-result/m-p/481572#M193097 to4kawa 2020-04-21T21:47:38Z