https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288510#M87362 <P>Try like this (runanywhere search, everything except last line is just to generate sample data)</P> <PRE><CODE>| gentimes start=-1 | eval Range="2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|" | table Range | eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#\1"),"#LB#") </CODE></PRE> Tue, 07 Feb 2017 16:15:01 GMT somesoni2 2017-02-07T16:15:01Z https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288508#M87360 <P>I have a field which have multilines, how to split this field delimited by timestamp into separate lines</P> <P>2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|</P> Tue, 07 Feb 2017 09:30:13 GMT https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288508#M87360 srinathd 2017-02-07T09:30:13Z https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288509#M87361 <P>Have you tried putting <CODE>BREAK_ONLY_BEFORE_DATE = true</CODE> in your props.conf file?</P> Tue, 07 Feb 2017 15:42:23 GMT https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288509#M87361 richgalloway 2017-02-07T15:42:23Z https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288510#M87362 <P>Try like this (runanywhere search, everything except last line is just to generate sample data)</P> <PRE><CODE>| gentimes start=-1 | eval Range="2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|" | table Range | eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#\1"),"#LB#") </CODE></PRE> Tue, 07 Feb 2017 16:15:01 GMT https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288510#M87362 somesoni2 2017-02-07T16:15:01Z https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288511#M87363 <P>Actually i tried with | eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#$1"),"#LB#"), later got it. Thanks.</P> Wed, 08 Feb 2017 07:44:49 GMT https://community.splunk.com/t5/Splunk-Search/Split-multiline-value-field-into-separate-lines/m-p/288511#M87363 srinathd 2017-02-08T07:44:49Z