Splunk Search

How to split multiple vlaues in single cell to new line in join search

gravi
Explorer

There few columns in the table that has multiple values in single line. I need them to be in separate/ newlines.

Current result preview: 4 12 22 87 2
Expected result view :
4
12
22
87
2

How do i achieve this?

0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults
| eval sample="4 12 22 87 2"
| makemv delim=" " sample

Hi, If you just want to separate it, you can use makemv command.

View solution in original post

to4kawa
Ultra Champion
| makeresults
| eval sample="4 12 22 87 2"
| makemv delim=" " sample

Hi, If you just want to separate it, you can use makemv command.

anthonymelita
Contributor

You can also use the split() eval command.
| makeresults
| eval sample="4 12 22 87 2"
| eval sample=split(sample, " ")
| mvexpand sample

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...