In the Splunk app, the exception message column has multiple line message in it. However, when same query is applied to the table event in the Splunk Dashboard Studio, the newline isn't considered, and message is read continuously. Below is the Splunk app result. Below is the table shown in the Studio. Below is the Splunk Query.   index="eqt-e2e" | spath suite_build_name | search suite_build_name="PAAS-InstantInk-Stage-Regression-Smooth-Transition" | spath unit_test_name_failed{} output=unit_test_name_failed | mvexpand unit_test_name_failed | spath input=unit_test_name_failed | where message!="Test was skipped" | spath suite_build_number | search suite_build_number="*" | where (if("*"="*", 1=1, like(author, "%*%"))) | where (if("*"="*", 1=1, like(message, "%*%"))) | spath suite_build_start_time | sort - suite_build_start_time | eval suite_build_time = strftime(strptime(suite_build_start_time, "%Y-%m-%d %H:%M:%S"), "%I:%M %p") | table suite_build_name, suite_build_number, suite_build_time, author, test_rail_name, message | rename suite_build_name AS "Pipeline Name", suite_build_number AS "Pipeline No.", suite_build_time AS "Pipline StartTime (UTC)", author AS "Test Author", test_rail_name AS "Test Name", message AS "Exception Message"   @ITWhisperer  ... View more

Query is to retrieve failed test case matching with exception message. Out of 6 failed test case, one test as exception and rest of them are skipped with message 'Test was skipped'. Below data of one event.      { "suite_build_id": "20241015.12", "suite_build_name": "pipeline_name", "unit_test_name_failed": [ { "message": "Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance.", "test_rail_name": "test_printer_order_placement_magento", "test_result": "fail" }, { "message": "Test was skipped", "test_rail_name": "test_updation_of_access_token", }, { "message": "Test was skipped", "test_name": "test_printer_and_user_details", "test_rail_name": "test_printer_and_user_details", } ] }      Now, I want to display result to show test_rail_name and exception_message which matches exception. Below is the query that I tried.     index="eqt-e2e" suite_build_name="pipeline-name" suite_build_number="20241015.12" | mvexpand unit_test_name_failed{}.message | mvexpand unit_test_name_failed{}.test_rail_name | search unit_test_name_failed{}.message="Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance." | table suite_build_number, suite_build_start_time, unit_test_name_failed{}.test_rail_name, unit_test_name_failed{}.message | rename suite_build_number AS "Pipeline Number", suite_build_start_time AS "Pipeline Date", unit_test_name_failed{}.test_rail_name AS "Test Name", unit_test_name_failed{}.message AS "Exception Message"     In the result, it should have been 1 event, but retrieve 6 events.  I understand, mvexpand works only on one multivalue fields, and here I have 2 multivalue fields. Let me know if there is any solution on retrieving the data. ... View more