How do I split an event with extracted fields into rows?

[shaheelkhan59]

Hello all,

I've used the following SPL to extract some fields from my logs.

I got the following result.

My issue is that each row in pic2 is not in separate rows. They are a part of an event. I want each row in Pic2 as separate rows. How this can be done?

i've tried mvexpand, but I didn't get the required format.

[shaheelkhan59]

I did this. It also worked perfectly

[richgalloway · Accepted solution]

The mvexpand command is the answer, but it's a little tricky because you have several multi-value fields. See Example 3 in the mvexpand docs at http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Mvexpand#Examples.

[shaheelkhan59]

Thanks richgalloway it worked perfect. Thanks again for quick response. Following pics shows what I changedalt text