https://community.splunk.com/t5/Splunk-Search/How-to-make-a-loop-in-one-event/m-p/590470#M205581 <P>Is event a multivalue field - if so, use mvexpand to expand to multiple events, then you can extract server, host and status from the event field</P> Wed, 23 Mar 2022 15:35:58 GMT ITWhisperer 2022-03-23T15:35:58Z https://community.splunk.com/t5/Splunk-Search/How-to-make-a-loop-in-one-event/m-p/590467#M205578 <P>My log is like this:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%">Time</TD><TD width="50%">Event</TD></TR><TR><TD width="50%">3/23/22 11:00:00.000 AM</TD><TD width="50%"><P>Application 'AAA' is running</P><P>Application 'BBB' is stopped</P><P>Database 'CCC' is running</P><P>Database 'DDD' is running</P></TD></TR><TR><TD width="50%">3/23/22 11:10:00.000 AM</TD><TD width="50%"><P>Application 'AAA' is running</P><P>Application 'BBB' is running</P><P>Database 'CCC' is stopped</P><P>Database 'DDD' is running</P></TD></TR></TBODY></TABLE><P>&nbsp;</P><P>I want to extract a table like</P><TABLE border="1" width="100%"><TBODY><TR><TD width="25%">Time</TD><TD width="25%">Server</TD><TD width="25%">Host</TD><TD width="25%">Status</TD></TR><TR><TD width="25%">3/23/22 11:00:00.000 AM</TD><TD width="25%">Application</TD><TD width="25%">AAA</TD><TD width="25%">running</TD></TR><TR><TD width="25%">3/23/22 11:00:00.000 AM</TD><TD width="25%">Application</TD><TD width="25%">BBB</TD><TD width="25%">stopped</TD></TR><TR><TD width="25%">3/23/22 11:00:00.000 AM</TD><TD width="25%">Database</TD><TD width="25%">CCC</TD><TD width="25%">running</TD></TR><TR><TD width="25%">3/23/22 11:00:00.000 AM</TD><TD width="25%">Database</TD><TD width="25%">DDD</TD><TD width="25%">running</TD></TR><TR><TD width="25%">3/23/22 11:10:00.000 AM</TD><TD width="25%">Application</TD><TD width="25%">AAA</TD><TD width="25%">running</TD></TR><TR><TD width="25%">3/23/22 11:10:00.000 AM</TD><TD width="25%">Application</TD><TD width="25%">BBB</TD><TD width="25%">running</TD></TR><TR><TD width="25%">3/23/22 11:10:00.000 AM</TD><TD width="25%">Database</TD><TD width="25%">CCC</TD><TD width="25%">stopped</TD></TR><TR><TD width="25%">3/23/22 11:10:00.000 AM</TD><TD width="25%">Database</TD><TD width="25%">DDD</TD><TD width="25%">running</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>How to do this? If anyone has idea?</P> Wed, 23 Mar 2022 15:32:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-loop-in-one-event/m-p/590467#M205578 sabinayang 2022-03-23T15:32:06Z https://community.splunk.com/t5/Splunk-Search/How-to-make-a-loop-in-one-event/m-p/590470#M205581 <P>Is event a multivalue field - if so, use mvexpand to expand to multiple events, then you can extract server, host and status from the event field</P> Wed, 23 Mar 2022 15:35:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-loop-in-one-event/m-p/590470#M205581 ITWhisperer 2022-03-23T15:35:58Z