Getting Data In

Help with rex- How do separate this event that came at the same time but different values?

Italy1358
Path Finder

I have an event that came in the same time but have different data values that I need to separate. 

Example

_time example A
2022-09-02 dgde746gdhu4
duyheuye4d0


I need this:

_time example A
2022-09-02 dgde746gdhu4
2022-09-02 duyheuye4d0
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the mvexpand command to separate the values of the example A field into separate events.

| mvexpand 'example A'
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...