Unable to break events using multikv?

[sarvesh_11]

Hi Splunkers,
Please find attached image, this is the way i am getting my data.
My desired format is :

Hostname | Microsoft .NET Framework 4.5.1 | Microsoft POS for .NET 1.12 | JAVA 8 Update 60 | UniversalForwarder | - -------
hostA | 4.5.50938 | 1.12.1296 | 8.0.600 | 7.2.5 | - -------

My procedure is, to break the events with multikv and then use transpose.

But multikv is not functioning as desired.

TIA,

[vnravikumar]

Hi

Attachment is missing.

[sarvesh_11]

hi @vnravikumar ,

Updated

[to4kawa · Accepted solution]

| rex mode=sed "s/\s\s+/,/g"
| multikv forceheader=2

try this.

[sarvesh_11]

Thanks @to4kawa