<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: multikv extraction fails when table contains empty fields in All Apps and Add-ons</title>
    <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97652#M6735</link>
    <description>&lt;P&gt;Thanks, I have filed NIX-317 and will update you when I have more information on the fix.  It seems like we can just put "null" in the type column when we aren't able to discern the fs type.&lt;/P&gt;</description>
    <pubDate>Mon, 22 Jul 2013 04:42:54 GMT</pubDate>
    <dc:creator>araitz</dc:creator>
    <dc:date>2013-07-22T04:42:54Z</dc:date>
    <item>
      <title>multikv extraction fails when table contains empty fields</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97647#M6730</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I am trying to use multikv to parse the output of df.sh, which is part of the *nix application.  On Solaris, the output of df.sh looks like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Filesystem                                          Type              Size        Used       Avail      UsePct    MountedOn
/dev/md/dsk/d15                                     ufs               9.6G        3.8G        5.7G         40%    /
sharefs                                             sharefs             0K          0K          0K          0%    /etc/dfs/sharetab
10.173.22.82:/vol/vf_slog_lons01_logs_vol01/archive_q01                    1.5T        1.3T        214G         86%    /logpool/logs/archive_global
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Using multikv against this table results in the following mapping for the last line (NFS mount), due to an empty/null entry for Type:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Filesystem: 10.173.22.82:/vol/vf_slog_lons01_logs_vol01/archive_q01
Type: 1.5T
Size: 1.3T
Used: 214G
Avail: 86%
UsePct: /logpool/logs/archive_global
MountedOn: &amp;lt;null&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;All other rows extract correctly, given that they have a value for Type.&lt;/P&gt;

&lt;P&gt;So, how can I get multikv to extract the fields correctly for all rows?&lt;/P&gt;

&lt;P&gt;Regards,&lt;BR /&gt;
Brett.&lt;/P&gt;</description>
      <pubDate>Wed, 17 Jul 2013 06:43:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97647#M6730</guid>
      <dc:creator>brettw10</dc:creator>
      <dc:date>2013-07-17T06:43:39Z</dc:date>
    </item>
    <item>
      <title>Re: multikv extraction fails when table contains empty fields</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97648#M6731</link>
      <description>&lt;P&gt;Could you please post the search query used? I have checked multikv was working ...&lt;/P&gt;</description>
      <pubDate>Wed, 17 Jul 2013 13:08:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97648#M6731</guid>
      <dc:creator>linu1988</dc:creator>
      <dc:date>2013-07-17T13:08:24Z</dc:date>
    </item>
    <item>
      <title>Re: multikv extraction fails when table contains empty fields</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97649#M6732</link>
      <description>&lt;P&gt;This looks like a bug in df.sh on Solaris.  What specific version of Solaris?  Let us know and we will try to fix.&lt;/P&gt;</description>
      <pubDate>Wed, 17 Jul 2013 18:11:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97649#M6732</guid>
      <dc:creator>araitz</dc:creator>
      <dc:date>2013-07-17T18:11:27Z</dc:date>
    </item>
    <item>
      <title>Re: multikv extraction fails when table contains empty fields</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97650#M6733</link>
      <description>&lt;P&gt;Solaris 10.  Here is some (edited) output, due to the character limit of replies.&lt;/P&gt;

&lt;P&gt;% df -n&lt;BR /&gt;
/                  : ufs&lt;BR /&gt;
/logpool/logs/archive_global: nfs&lt;/P&gt;

&lt;P&gt;% df -h&lt;BR /&gt;
Filesystem             size   used  avail capacity  Mounted on&lt;BR /&gt;
/dev/md/dsk/d15        9.6G   3.8G   5.7G    41%    /&lt;BR /&gt;
10.173.22.82:/vol/vf_slog_lons01_logs_vol01/archive_q01&lt;BR /&gt;
                       1.5T   1.3T   205G    87%    /logpool/logs/archive_global&lt;/P&gt;

&lt;P&gt;If I can ever get this site to let me post the full output, I will.&lt;/P&gt;

&lt;P&gt;Rgds,&lt;BR /&gt;
Brett.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 14:22:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97650#M6733</guid>
      <dc:creator>brettw10</dc:creator>
      <dc:date>2020-09-28T14:22:27Z</dc:date>
    </item>
    <item>
      <title>Re: multikv extraction fails when table contains empty fields</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97651#M6734</link>
      <description>&lt;P&gt;And df.sh:&lt;/P&gt;

&lt;P&gt;% df.sh&lt;BR /&gt;
Filesystem                                          Type              Size        Used       Avail      UsePct    MountedOn&lt;BR /&gt;
/dev/md/dsk/d15                                     ufs               9.6G        3.8G        5.7G         41%    /&lt;BR /&gt;
10.173.22.82:/vol/vf_slog_lons01_logs_vol01/archive_q01                    1.5T        1.3T        205G         87%    /logpool/logs/archive_global&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 14:22:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97651#M6734</guid>
      <dc:creator>brettw10</dc:creator>
      <dc:date>2020-09-28T14:22:30Z</dc:date>
    </item>
    <item>
      <title>Re: multikv extraction fails when table contains empty fields</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97652#M6735</link>
      <description>&lt;P&gt;Thanks, I have filed NIX-317 and will update you when I have more information on the fix.  It seems like we can just put "null" in the type column when we aren't able to discern the fs type.&lt;/P&gt;</description>
      <pubDate>Mon, 22 Jul 2013 04:42:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97652#M6735</guid>
      <dc:creator>araitz</dc:creator>
      <dc:date>2013-07-22T04:42:54Z</dc:date>
    </item>
    <item>
      <title>Re: multikv extraction fails when table contains empty fields</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97653#M6736</link>
      <description>&lt;P&gt;Hi &lt;/P&gt;

&lt;P&gt;Is there any workaround in multikv.conf, column with missing values are being assigned  values from next header with values..&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;Subsystem/Job  User        Number   User        Type Pool Pty     CPU   Int    Rsp  AuxIO   CPU%  Function       Status   Threads&lt;BR /&gt;
   JDENET_K     ONEWORLD    01267   ONEWORLD    BCI    8  20   15884.2                  1    1.9  jvmStart  DEQW         33&lt;BR /&gt;
   QSRVERR      QUSER       00129   ONEWORLD    PJ     2  20   18277.8               3832     .9                  CNDW          1&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;Int &amp;amp; Rsp&lt;/STRONG&gt; are blank &amp;amp; get values of &lt;STRONG&gt;AuxIO &amp;amp; CPU%&lt;/STRONG&gt; respectively&lt;/P&gt;</description>
      <pubDate>Mon, 03 Aug 2015 10:29:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/multikv-extraction-fails-when-table-contains-empty-fields/m-p/97653#M6736</guid>
      <dc:creator>stanwin</dc:creator>
      <dc:date>2015-08-03T10:29:46Z</dc:date>
    </item>
  </channel>
</rss>

