I'm trying to upload a CSV file into Splunk, however, it doesn't seem to parse it correctly for the multiple values fields. Here is the data I have: rule,source_address, dest_address, proto Test, 1.1.1.1 1.2.2.2 1.3.3.3, 4.4.4.4 4.4.5.5, icmp https I want all the source address/dest address/application in a separate row so that they are independent for searching, but I couldn't get it to work. After I uploaded the file, if I looked at the extracted field for source_address, it will show all three in 1 line (e.g source_address="1.1.1.1 1.2.2.2 1.3.3.3") instead of 3 unique values Desire output when running " index=test | table rule, source_address, dest_address, proto " without EVAL, makemv, etc: For now, I have: I have tried modifying props.conf and transforms.conf such as the following and other suggestions I found in https://answers.splunk.com/, but nothing seems to work. props.conf: [my_sourcetype] DELIMS = "," FIELDS = rule, source_address, dest_address, proto REPORT-extract_space = extract_space transforms.conf [extract_space] DELIMS = " " FIELDS = source_address, dest_address, proto How can I get these columns to parse correctly? Please help! Thanks in advance! ... View more