@jrodriguezap Can you try this, | eval pair=mvzip('Instance name', 'Search execution time', "||") | mvexpand pair | eval "Instance name"=mvindex(split(pair,"||"),0), "Search execution time"=...
See more...
@jrodriguezap Can you try this, | eval pair=mvzip('Instance name', 'Search execution time', "||") | mvexpand pair | eval "Instance name"=mvindex(split(pair,"||"),0), "Search execution time"=mvindex(split(pair,"||"),1) | fields "Domain Name" "Instance name" "Last Phone home" "Search execution time" Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!