How to format alerts email message in alert search, and split the message over multiple lines

[edwinmae]

Hi,

I use the following in the Alert Search to get the Email Message (body) in the Splunk Results output:

| eval Alert_Message= "Text A, Text B, Text C"
| table Alert_Message ...

It shows the Message in the Splunk Results output in 'One single line' > Text A, Text B, Text C

**

Is it possible to get the Splunk Results output, e.g. in 3 Lines?
Text A
Text B
Text C

[edwinmae]

I actually solved it myself, by adding a star after each line, and using | makemv delim="*" Alert_Message

[aberkow]

You can also use the mvexpand command here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Mvexpand. You should post/accept an answer or close the question to mark it as resolved!