- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello all,
I've used the following SPL to extract some fields from my logs.
I got the following result.
My issue is that each row in pic2 is not in separate rows. They are a part of an event. I want each row in Pic2 as separate rows. How this can be done?
i've tried mvexpand
, but I didn't get the required format.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The mvexpand
command is the answer, but it's a little tricky because you have several multi-value fields. See Example 3 in the mvexpand docs at http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Mvexpand#Examples.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The mvexpand
command is the answer, but it's a little tricky because you have several multi-value fields. See Example 3 in the mvexpand docs at http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Mvexpand#Examples.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content