Separate the fields from a merged result

[s_kandula]

Hi

I have two events with following fields
Event 1
Log.Status : IN
TransactionTime : IN time
Tracking id: Unique ID (common between Event 1 and 2)

Event 2
Log.Status :OUT
TransactionTime: OUTtime
Trackingid

I merged the events using tracking ID and i got the required fields. But under transactionTime, I am seeing two times (IN and OUT) one below the other. Is there a way to list the times as separate fields in the merge results.

[to4kawa]

use mvindex in eval

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

[s_kandula]

Thanks , I was able to get two separate fields based on the Status using the eval command.

[to4kawa]

I see, please accept my answer.