topic Re: How to split multiple lines of data into a single individual line in splunk using \n? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564361#M196605 <LI-CODE lang="markup">| eval Prod=split(Prod," ") | mvexpand Prod</LI-CODE> Mon, 23 Aug 2021 14:43:14 GMT ITWhisperer 2021-08-23T14:43:14Z How to split multiple lines of data into a single individual line in splunk using \n? https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564358#M196602 <P>As i mentioned below prod column has multiple values and i want to split it based on \n next line command and get the output as mentioned in output image.</P><P><STRONG>Current data:</STRONG></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Shan_0-1629728821294.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15671i3D8F700AD5D24B12/image-size/medium?v=v2&amp;px=400" role="button" title="Shan_0-1629728821294.png" alt="Shan_0-1629728821294.png" /></span></P><P><STRONG>Expected output:</STRONG></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Shan_1-1629728934077.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15672iC782A229CA3DD92B/image-size/medium?v=v2&amp;px=400" role="button" title="Shan_1-1629728934077.png" alt="Shan_1-1629728934077.png" /></span></P><P>Thanks in advance ..</P> Mon, 23 Aug 2021 14:34:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564358#M196602 Shan 2021-08-23T14:34:24Z Re: How to split multiple lines of data into a single individual line in splunk using \n? https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564361#M196605 <LI-CODE lang="markup">| eval Prod=split(Prod," ") | mvexpand Prod</LI-CODE> Mon, 23 Aug 2021 14:43:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564361#M196605 ITWhisperer 2021-08-23T14:43:14Z Re: How to split multiple lines of data into a single individual line in splunk using \n? https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564370#M196607 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P><P>Thanks for your input. But its not working .</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Shan_1-1629731597744.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15675iDFCB7BF1EE00C48D/image-size/large?v=v2&amp;px=999" role="button" title="Shan_1-1629731597744.png" alt="Shan_1-1629731597744.png" /></span></P> Mon, 23 Aug 2021 15:14:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564370#M196607 Shan 2021-08-23T15:14:09Z Re: How to split multiple lines of data into a single individual line in splunk using \n? https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564375#M196608 <P>The split has the newline in quotes - hint: use &lt;shift&gt;&lt;return&gt; to insert into search</P> Mon, 23 Aug 2021 15:24:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564375#M196608 ITWhisperer 2021-08-23T15:24:21Z Re: How to split multiple lines of data into a single individual line in splunk using \n? https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564389#M196610 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR /><BR />Sorry, I'm not able to follow you. Can you please give me an example query..<BR /><BR />Thanks in advance ..</P> Mon, 23 Aug 2021 16:12:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564389#M196610 Shan 2021-08-23T16:12:34Z Re: How to split multiple lines of data into a single individual line in splunk using \n? https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564401#M196616 <PRE>| eval Prod=split(Prod," ") | mvexpand Prod</PRE><P>If this is not working, can you share your search in the same way i.e. in a code block &lt;/&gt;</P> Mon, 23 Aug 2021 17:29:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564401#M196616 ITWhisperer 2021-08-23T17:29:33Z Re: How to split multiple lines of data into a single individual line in splunk using \n? https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564469#M196636 <P class="lia-align-justify"><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P><P class="lia-align-justify">Thanks for your input . As i mentioned Split not helped me.<BR />I can able to achieve what i expected with below solution.</P><LI-CODE lang="markup">| makemv tokenizer="([^\r\n]+)(\r\n)?" Prod | mvexpand Prod</LI-CODE><P><span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 24 Aug 2021 06:26:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-multiple-lines-of-data-into-a-single-individual/m-p/564469#M196636 Shan 2021-08-24T06:26:17Z