https://community.splunk.com/t5/Splunk-Search/Help-with-Query-value-in-a-column-as-per-line-instead-of/m-p/602033#M209544 <P>Thank you so much. This fixed my problem.</P> Thu, 16 Jun 2022 08:45:59 GMT intrach 2022-06-16T08:45:59Z https://community.splunk.com/t5/Splunk-Search/Help-with-Query-value-in-a-column-as-per-line-instead-of/m-p/601873#M209472 <P>Hello anyone,</P> <P>I need your splunk expertise. I have this lookup that is captured from a first query. Now I want my second query to search the values in “domain” column, however, you look at domain column it contains multiple values for domain and somehow when I query it, it reads it as one value instead of searching per line.</P> <P>So instead of searching just:<BR />1.fhgvfshdvcshdcsdfce6352dgcvgdcagnbdcjsagdvcwe.aski**bleep**a.com</P> <P>And then</P> <P>10.olskxqu287284y84fjwedwed2762391389hvhvivb87y38.aski**bleep**a.com</P> <P>And then</P> <P>11.qu28snmkjsamclk287284y84fjwedwed27623xcaolskx.aski**bleep**a.com</P> <P>&nbsp;</P> <P>It instead searches for domain</P> <P>“1.fhgvfshdvcshdcsdfce6352dgcvgdcagnbdcjsagdvcwe.aski**bleep**a.com 10.olskxqu287284y84fjwedwed2762391389hvhvivb87y38.aski**bleep**a.com 11.qu28snmkjsamclk287284y84fjwedwed27623xcaolskx.aski**bleep**a.com 12.njvh476xcaol4y84fjwedwed2764fncdjkasnmkjs.aski**bleep**a.com 13.caolskxqu2842fwefd9232476xcaolskscajcj47653.aski**bleep**a.com 14.jbdcwye6732hbsdjuhbjahsbayu723622gfwbfhsdbj.aski**bleep**a.com 15.2762391389hvhvivb87yqu28snmkjsamclk2.jwedwed2.aski**bleep**a.com 2.842fwefjwhbjhascajcjshbuwyrf6t376trf2gdvwqgdvqadqwscqw.gdyt326fgev.aski**bleep**a.com 3.842fwefjwhbjhascajcjsh76327dhqbd92324765364734snjvh348.qadqw.aski**bleep**a.com 4.ce6352ddcjsscajcj476536473bjhascajcjshbuwyrf6.aski**bleep**a.com 5.hgvdcywtewygcvhxcaolskxqu287284y84fncdjkasnmkjsamclk.aski**bleep**a.com 6.dcjsscajcj4vhxcaolskxqu28snmkjsamclk.aski**bleep**a.com 7.h76327dhqbd9232476xcaolskxqu2842fwefjwhbjhasc.aski**bleep**a.com 8.92324765364734snjvh476xcaolsjshdbc.lsk.aski**bleep**a.com 9.d9232476xcaolskscajcj476536473bjhaswyrf6.aski**bleep**a.com”</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture_splunk.JPG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/20110iA621BB350C077247/image-size/large?v=v2&amp;px=999" role="button" title="Capture_splunk.JPG" alt="Capture_splunk.JPG" /></span></P> Wed, 15 Jun 2022 18:23:18 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Query-value-in-a-column-as-per-line-instead-of/m-p/601873#M209472 intrach 2022-06-15T18:23:18Z https://community.splunk.com/t5/Splunk-Search/Help-with-Query-value-in-a-column-as-per-line-instead-of/m-p/601890#M209482 <P>Split the multivalue field into multiple events.</P><LI-CODE lang="markup">| mvexpand domain</LI-CODE> Wed, 15 Jun 2022 10:08:03 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Query-value-in-a-column-as-per-line-instead-of/m-p/601890#M209482 ITWhisperer 2022-06-15T10:08:03Z https://community.splunk.com/t5/Splunk-Search/Help-with-Query-value-in-a-column-as-per-line-instead-of/m-p/602033#M209544 <P>Thank you so much. This fixed my problem.</P> Thu, 16 Jun 2022 08:45:59 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Query-value-in-a-column-as-per-line-instead-of/m-p/602033#M209544 intrach 2022-06-16T08:45:59Z