Extracting the repeated fields from _raw

[tomarcen]

Hi.
I've load splunk with my email logs.
I'm getting all the url's in an email in _raw field.

In an e-mail, if there are 10 hyperlinks, I'm getting all the links as url in _raw , but I need them in a column of a table with url & sender columns.

When I pipe and table the output, I'm getting only the first url as the output In url field.

So how to get all the url's tabled in same column.

[tomarcen]

That dint work. I tried and got the same output - only the first url is showing.

Problem is all the repeated fields like url or recipients are in same event of splunk..

So, I need a query to get the repeated fields like url or recipient repeated multiple times in same event.

In simple words : in one event, I'm getting multiple recipients but after using the above query also, I'm getting the same result(only the first url or recipient in that event)

[kml_uvce]

try this
your search| eval url_name=mvjoin(url, ";")|table url_name