Splunk Search

Seperate Multivalue Fields with Carriage Return Delimiter

mistydennis
Communicator

Hi all - I have data that appears like this:

Field=Animal
Cat
Dog
Fish

Dog
Fish

Horse
Cat
Dog
Pig

.....where multiple values are populating one cell, all separated by a carriage return. There are not the same number of values in each cell, sometimes 1, sometimes 5. I know how to separate these out when there is a comma or a semicolon used as a delimiter, but how do I separate these kind of values that have no visible delimiter?

Tags (1)
0 Karma

493669
Super Champion

Hi @mistydennis,
Use mvexpand command to separate multivalue fields:

...|mvexpand Animal

Reference: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Mvexpand

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...