Splunk Search
Highlighted

How to split multiple vlaues in single cell to new line in join search

Explorer

There few columns in the table that has multiple values in single line. I need them to be in separate/ newlines.

Current result preview: 4 12 22 87 2
Expected result view :
4
12
22
87
2

How do i achieve this?

0 Karma
Highlighted

Re: How to split multiple vlaues in single cell to new line in join search

Ultra Champion
| makeresults
| eval sample="4 12 22 87 2"
| makemv delim=" " sample

Hi, If you just want to separate it, you can use makemv command.

View solution in original post

Highlighted

Re: How to split multiple vlaues in single cell to new line in join search

Communicator

You can also use the split() eval command.
| makeresults
| eval sample="4 12 22 87 2"
| eval sample=split(sample, " ")
| mvexpand sample

0 Karma