Hi all - I have data that appears like this:
Field=Animal
Cat
Dog
Fish
Dog
Fish
Horse
Cat
Dog
Pig
.....where multiple values are populating one cell, all separated by a carriage return. There are not the same number of values in each cell, sometimes 1, sometimes 5. I know how to separate these out when there is a comma or a semicolon used as a delimiter, but how do I separate these kind of values that have no visible delimiter?
Hi @mistydennis,
Use mvexpand
command to separate multivalue fields:
...|mvexpand Animal
Reference: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Mvexpand