Splunk Search

Transform a field into table view

MikeJu25
Path Finder

Hi,

I have a field called sequence_anomalies which consists of a lot of individual elements. Once I made it into a table, it looks like below. Now I am wondering if it's possible to make a table view where each row only contains one element instead of all elements being in one row. 

image.png

image.png

 Thank you in advance!

Regards,

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval sequence_anomalies=split(sequence_anomalies," ")
| mvexpand sequence_anomalies

By the way, the images are quite small, it would have been better to have pasted the data into a code block </>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval sequence_anomalies=split(sequence_anomalies," ")
| mvexpand sequence_anomalies

By the way, the images are quite small, it would have been better to have pasted the data into a code block </>

MikeJu25
Path Finder

Sure will do in the future! Thank you for your answer! 

0 Karma
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...