I'm using stats to group sets of data by IP C blocks. When I export the data I am looking for( in this case multiple user ID's per C) is formatted by a space per unique user id rather than a carriage return. When viewing the results prior to export in the web client the returned values are returned one per line, however when exporting its all values on one line separated by a space. Is there any way to separate values with a return rathern than a space? IE i see the following in the web client: values(UserId) ### ### ### ### however when exported into a csv i see(when opening with excel) values(UserId) ### ### ### ### I would prefer to have one result per line else i will need to post process the results and replace the spaces with returns. Edit for clarification: I am using quite a few additional columns in the CSV export, multiple values can occur in each additional column and ideally each event would display the corresponding values for each column. The results i get back look like (only using the first 6 due to formatting constraints) the following except every unique value for each Cblock is listed one after another on the same line, eg multiple email addresses and userid's per line separated by a space: Cblock values(UserId) values(Email) values(SignupIP) Values(IPCountry) values( PreferredCulture) 1.2.3 #### ####... people@fqd.com... 1.2.3.4 1.2.3.5... US en-us What i would hope to get back is: Cblock values(UserId) values(Email) values(SignupIP) Values(IPCountry) values( PreferredCulture) 1.2.3 #### people@fqd.com 1.2.3.4 US en-us 1.2.3 #### people1@fqd.com 1.2.3.5 US en-us 1.2.3 #### people4@fqd.com 1.2.3.7 US en-us 1.6.4 #### man@fqd1.com 1.6.4.2 PK en-us 1.6.4 #### bear@fqd1.com 1.6.4.6 PK en-us 1.6.4 #### dog@fqd1.com 1.6.4.8 PK en-us Sample of the log i am working with: 2012-01-31 09:58:00,112 Log="foo" SignupFeature = BAR Message = Welcome Email sent UserId = #### Email = people@domain.com FLName = "firstname.lastname" SignupIP = ###.###.###.### IPCountry = US PreferredCulture = en-us Referer = https://domain.com And the search i'm using to pull the data out (additional values are used but are removed for the example) SignupFeature="BAR" | rex field=SignupIP "(?<Cblock>\d+\.\d+\.\d+)" | stats values(UserId) values(Email) values(SignupIP) values(IPCountry) values(PreferredCulture) values(Referer) count(Cblock) AS Blocks BY Cblock | where Blocks>=2 The overall basic idea is to to group events by /24, gather all fields for all grouped events and export the matching grouped events with all fields in a format that lists one event per line Lastly here is a sample of the formatted results i am seeing in the web client. ... View more