<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to Split rows into columns in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-Split-rows-into-columns/m-p/633980#M220192</link>
    <description>&lt;P&gt;Thanks a lot!&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 10 Mar 2023 02:57:20 GMT</pubDate>
    <dc:creator>vik</dc:creator>
    <dc:date>2023-03-10T02:57:20Z</dc:date>
    <item>
      <title>How to Split rows into columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-Split-rows-into-columns/m-p/633968#M220181</link>
      <description>&lt;P&gt;I am trying to split the values in both the columns and create 5 rows by assigning respective values. I need an output as below. Can someone suggest how can I achieve this ?&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;I tried mvexpand but it does not seem to help. Anything else we can try ?&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;field1&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;| field 2&amp;nbsp;&lt;/P&gt;&lt;P&gt;-------------------------------&lt;/P&gt;&lt;P&gt;Name 1&amp;nbsp; &amp;nbsp;|&amp;nbsp; 10&lt;/P&gt;&lt;P&gt;-------------------------------&lt;/P&gt;&lt;P&gt;Name 2&amp;nbsp; &amp;nbsp;| 12&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screen Shot 2023-03-09 at 5.14.59 PM.png"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/24273i5B393F3B9E72B107/image-size/medium?v=v2&amp;amp;px=400" alt="Screen Shot 2023-03-09 at 5.14.59 PM.png" title="Screen Shot 2023-03-09 at 5.14.59 PM.png" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 10 Mar 2023 00:22:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-Split-rows-into-columns/m-p/633968#M220181</guid>
      <dc:creator>vik</dc:creator>
      <dc:date>2023-03-10T00:22:10Z</dc:date>
    </item>
    <item>
      <title>Re: How to Split rows into columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-Split-rows-into-columns/m-p/633970#M220183</link>
      <description>&lt;P&gt;How about something like this?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval tmp_field = mvzip(field1, field2, "-|-")
| fields - field1, field2
| mvexpand tmp_field
| makemv delim="-|-" tmp_field
| eval field1 = mvindex(tmp_field, 0)
| eval field2 = mvindex(tmp_field, 1)
| fields - tmp_field&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 10 Mar 2023 00:42:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-Split-rows-into-columns/m-p/633970#M220183</guid>
      <dc:creator>Tom_Lundie</dc:creator>
      <dc:date>2023-03-10T00:42:51Z</dc:date>
    </item>
    <item>
      <title>Re: How to Split rows into columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-Split-rows-into-columns/m-p/633980#M220192</link>
      <description>&lt;P&gt;Thanks a lot!&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 10 Mar 2023 02:57:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-Split-rows-into-columns/m-p/633980#M220192</guid>
      <dc:creator>vik</dc:creator>
      <dc:date>2023-03-10T02:57:20Z</dc:date>
    </item>
  </channel>
</rss>

