Hi, I have this Splunk SPL: index=EventViewer source="WinEventLog:Application" SourceName=sample
| table host Name, Description, Location Name, Description, and Location are all multi value fields that directly corresponds to each other. Here is the sample for one of the hosts: Name Description Location
name1 description1 location1
name2 description2 location2
name3 description3 location3
name4 description4 location4 What I am trying to do is show each record for each host in a separate row. I cannot use mvexpand becasue there are millions of events and it causes the results to truncated due to the following warn message: command.mvexpand: output will be truncated at 35500 results due to excessive memory usage. I cannot do anything with limits.conf to adjust this memory limit so I need an alternative option to display each record in individual rows.
... View more