topic Re: Explode line into multiple lines in Splunk Search https://community.splunk.com/t5/Splunk-Search/Explode-line-into-multiple-lines/m-p/698829#M237271 <P><A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/mvexpand" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/mvexpand</A></P> Wed, 11 Sep 2024 20:18:55 GMT PickleRick 2024-09-11T20:18:55Z Explode line into multiple lines https://community.splunk.com/t5/Splunk-Search/Explode-line-into-multiple-lines/m-p/698828#M237270 <P>Howto to explode 1 row to several breaking out a multi-value field.</P><P>app=ABC client=AA views=View1,View2<BR />app=ABC client=AA views=View1,View2,View3<BR />app=ABC client=BB views=View1,View3<BR />app=ABC client=CC views=View3,View2,View1</P><P>I want to table that to column data:</P><P>app client view<BR />ABC AA View1<BR />ABC AA View2<BR />ABC AA View1<BR />ABC AA View2<BR />ABC AA View3<BR />ABC BB View1<BR />ABC BB View3<BR />ABC CC View3<BR />ABC CC View2<BR />ABC CC View1</P><P>So that I can run count on that resultant rows</P><P>app client view count<BR />ABC AA View1 2<BR />ABC AA View2 2<BR />ABC AA View3 1<BR />ABC BB View1 1<BR />ABC BB View3 1<BR />ABC CC View3 1<BR />ABC CC View2 1<BR />ABC CC View1 1</P> Wed, 11 Sep 2024 20:16:50 GMT https://community.splunk.com/t5/Splunk-Search/Explode-line-into-multiple-lines/m-p/698828#M237270 Yossarian622 2024-09-11T20:16:50Z Re: Explode line into multiple lines https://community.splunk.com/t5/Splunk-Search/Explode-line-into-multiple-lines/m-p/698829#M237271 <P><A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/mvexpand" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/mvexpand</A></P> Wed, 11 Sep 2024 20:18:55 GMT https://community.splunk.com/t5/Splunk-Search/Explode-line-into-multiple-lines/m-p/698829#M237271 PickleRick 2024-09-11T20:18:55Z Re: Explode line into multiple lines https://community.splunk.com/t5/Splunk-Search/Explode-line-into-multiple-lines/m-p/698835#M237273 <P>Yes!</P><P>a combination of makemv delim="," views</P><P>and mvexpand views</P><P>got me what I was looking for. thanks!</P> Wed, 11 Sep 2024 21:23:14 GMT https://community.splunk.com/t5/Splunk-Search/Explode-line-into-multiple-lines/m-p/698835#M237273 Yossarian622 2024-09-11T21:23:14Z