If there is really no delimiter, you can't, but in your case, there is a delimiter, which I am assuming in your example is the line feed at the end of each row. You can either do this by putting a line feed as the split delimiter | makeresults | eval field1="[email protected] [email protected] [email protected] scheduler" | eval x=split(field1, " ") | eval field1_items=mvcount(field1), fieldx_items=mvcount(x) or you can use replace+split to change the line feed into something easier to split with, e.g.  | eval x=split(replace(field1, "\n", "#!#"), "#!#") ... View more