The links to the 'other' questions/answers do not work anymore.
But what does work is:
| eval n=replace(my__field, "___", "
")
So literally add a newline to your code.
It is silly to need to do it in this way. Why are \n and similar characters as replacements not supported, while they are supported in the pattern. The replace function should also allow other options like replace only one occurrence or all occurrences (learn a bit from the Perl language I guess...)
If this helps anyone, I solved this using a streamstats which always resets:
...
| streamstats reset_before="1=1" list(mvfield) as mvfield
| table mvfield
See answers to the following questions:
http://splunk-base.splunk.com/answers/40033/add-line-breaks-with-eval
http://splunk-base.splunk.com/answers/41691/add-newline-into-table-cell
The second answer here http://splunk-base.splunk.com/answers/41691/add-newline-into-table-cell
Which says use split. That worked for me. Rex mode=sed doesn't work for me.
Thanks, nice catch. Fixed.
Thanks, just as a note, the mvjoin requires the eval statement in front of it.
Indent code blocks with 4 spaces on each line (or click the "1010101" button which does this for you). This will make code show up properly on the site. I fixed this for you this time though.