Is it possible to event break from a single field?

[rpraveena03]

I do have a multivalue field with the letters cls and tenant at the end of it. Is it possible to break the data into different rows.

[rpraveena03]

This log is already ingested into Splunk using custom command by the application team. Now I can't go back with props configuration. 

Is there any way to achieve through query from UI

[richgalloway]

Unfortunately, poorly-onboarded data stays that way forever.  That's why it's important to test the onboarding process before accepting new data.  I hope you've had a chat with the application team about that.

There is the split SPL function that can be used in conjunction with mvexpand to break a field into multiple events.  That function separates the field based on a single character rather than a string so it won't work in this case.

[richgalloway]

Try putting this in one of your props.conf files

[mysourcetype]
LINE_BREAKER = ()\{"_cls