To provide further from yesterday's SPL query. I am facing huge events in multivalues. I want to break in a single event. How can I achieve it.
My current events are look like as below.
let me better understand you need:
you have al these long error messages and you have them in a multivalue,you want to have each of them in a single event, is it correct?
Anyway, the method to transform a multivale in single events is mvexpand command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Mvexpand).
If you could share your final search I could be more precise in mvexpand use.