https://community.splunk.com/t5/Splunk-Search/how-to-break-down-a-record-in-multiple-rows/m-p/676167#M231289 <P>I have a records that comes with multiple items in a single row. Is there a way i can break it down in a single row. The rest of the values will be same and can be copied. In the screen shot below, can we break down the first row in two rows, second in 5 rows etc..&nbsp; Thanks in advance to the Splunk Community. They are super helpful.&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ezamit_0-1706732215548.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29186iB82F5B58C7FE8A6B/image-size/medium?v=v2&amp;px=400" role="button" title="ezamit_0-1706732215548.png" alt="ezamit_0-1706732215548.png" /></span></P><P>&nbsp;</P> Wed, 31 Jan 2024 20:18:43 GMT ezamit 2024-01-31T20:18:43Z https://community.splunk.com/t5/Splunk-Search/how-to-break-down-a-record-in-multiple-rows/m-p/676167#M231289 <P>I have a records that comes with multiple items in a single row. Is there a way i can break it down in a single row. The rest of the values will be same and can be copied. In the screen shot below, can we break down the first row in two rows, second in 5 rows etc..&nbsp; Thanks in advance to the Splunk Community. They are super helpful.&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ezamit_0-1706732215548.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29186iB82F5B58C7FE8A6B/image-size/medium?v=v2&amp;px=400" role="button" title="ezamit_0-1706732215548.png" alt="ezamit_0-1706732215548.png" /></span></P><P>&nbsp;</P> Wed, 31 Jan 2024 20:18:43 GMT https://community.splunk.com/t5/Splunk-Search/how-to-break-down-a-record-in-multiple-rows/m-p/676167#M231289 ezamit 2024-01-31T20:18:43Z https://community.splunk.com/t5/Splunk-Search/how-to-break-down-a-record-in-multiple-rows/m-p/676171#M231290 <P>Check out the <FONT face="courier new,courier">mvexpand</FONT> command.</P> Wed, 31 Jan 2024 21:09:35 GMT https://community.splunk.com/t5/Splunk-Search/how-to-break-down-a-record-in-multiple-rows/m-p/676171#M231290 richgalloway 2024-01-31T21:09:35Z https://community.splunk.com/t5/Splunk-Search/how-to-break-down-a-record-in-multiple-rows/m-p/676173#M231292 <P>Thanks&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;. I was able to break it down using mvexpand.</P> Wed, 31 Jan 2024 21:20:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-break-down-a-record-in-multiple-rows/m-p/676173#M231292 amitshrigoel 2024-01-31T21:20:21Z