How to separate events by using props/transforms?

[nonya_54]

I have logs that resemble the table below.

index=linux sourcetype=group | table group group_id, users

group	group_id	users
splunk	1	admin, john, jill
apache	2	sarah, bill

I would like the events to be separated by individual users so it looks like the table below. Is there a way to utilize transforms/props to separate the events by each different user? 

index=linux sourcetype=group | table group group_id, users

group	group_id	users
splunk	1	admin
splunk	1	john
splunk	1	jill
apache	2	sarah
apache	2	bill

[PickleRick]

You cannot do that. That's the short answer. There is no sane way of doing auch thing. When the event goes through the whole ingestion/indexing pipeline it is a single event. You can manipulate it, you can redirect it, you can extract fields, overwrite some parts of its data... But you can't split it into multiple events. You cant join multiple events into one either.

[VatsalJagani]

@nonya_54 - Try:

index=linux sourcetype=group | table group group_id, users
| makemv users delim=","
| mvexpand users

I hope this helps!!!

[nonya_54]

Hello. Thank you for the response. I would like to be able to utilize the backend of Splunk as opposed to an inline search for the desired results.

[VatsalJagani]

@nonya_54 - doing it from backend doesn't seem like a straight forward thing.

How you are collecting the data? If you are collecting it through script or something I would say you do it at that stage.

Doing it search time sounds still good as it will require less storage and license.