How to separate rows from a table ?

[cleal]

Hi

I´m new in splunk , I´m triying to build an table with this querie :

host="xxxx-pronto" | spath | rename logs{}.request.context.conversation_id AS id_Conversacion,logs{}.request.input.text AS Pregunta,logs{}.response.output.text{} AS Respuesta,logs{}.response_timestamp AS Fecha_Respuesta,logs{}.response.intents{}.intent AS Intencion | table id_Conversacion,Pregunta,Respuesta,Fecha_Respuesta,Intencion

But only i´m getting all results in a event .How can i separate all results in separate rows.

Thanks

[niketn]

@cleal you should consider configuration for event line breaking within JSON data to separate events while indexing. (you seem to have timestamp for each row of multi-value events, which is good for extracting event timestamp). This would imply more time in indexing the data (possibly though Heavy Forwarder, if you do not want to load the indexers). However, this would also imply less load during search time while processing multi-value fields.

[kmaron]

I had a similar issue here: https://answers.splunk.com/answers/623015/question-involving-breaking-out-multiple-multivalu.html

Maybe that answer can help you as well.