- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found this solution to my problem:
| stats delim=":" list(XYZ) as XYZ BY CRITERIA
| rex mode=sed field=XYZ "s/:/\n/g"
This gives you the results on new lines in the table emailed from splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks..I figured out the solution 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found this solution to my problem:
| stats delim=":" list(XYZ) as XYZ BY CRITERIA
| rex mode=sed field=XYZ "s/:/\n/g"
This gives you the results on new lines in the table emailed from splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Glad you found a solution @adityainamdar89 🙂 Be sure to accept your answer (clicking on the check mark to the left of this answer) so other users with similar issues will look to this post for help. You also get some karma points too!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You can for example set delim=";"
and your values will be separated by a semicolon... however, I haven't gotten a newline to work.
