I do have a multivalue field with the letters cls and tenant at the end of it. Is it possible to break the data into different rows.
This log is already ingested into Splunk using custom command by the application team. Now I can't go back with props configuration.
Is there any way to achieve through query from UI
Unfortunately, poorly-onboarded data stays that way forever. That's why it's important to test the onboarding process before accepting new data. I hope you've had a chat with the application team about that.
There is the split SPL function that can be used in conjunction with mvexpand to break a field into multiple events. That function separates the field based on a single character rather than a string so it won't work in this case.
Try putting this in one of your props.conf files
[mysourcetype]
LINE_BREAKER = ()\{"_cls