Thanks for answer, but my requirement is to capture all of it at same time as complete value. e.g. ..| table Session -> should return "PP|OO|GG". I think makemv will break whole value in array of values based on '|' delimiter, but I want to print them in different rows in table. I am trying regex only, but again regex is having few problems in my case, as log msg is bit volatile in format. Is there no way to have value as whole i.e. "PP|OO|GG"? and why does splunk is picking only first value?? Appreciate answers. Thanks Rakesh ... View more