F5 LTM Pool monitoring Events

[riqbal47010]

Under index=f5security sourcetype="f5:bigip:ltm:snmp:monitor:status", I can see that event pool status line is extracted as one one. but the last results are combined as shown in attached snapshot.

how to convert them into multiline

[riqbal47010]

below command solve my issue.

multikv noheader=t

index=f5security sourcetype="f5:bigip:ltm:snmp:monitor:status" | multikv noheader=t