https://community.splunk.com/t5/Splunk-Dev/Multikvs-on-Multiple-Lines/m-p/20900#M195 <P>Okay, I have decided to break the events into several chunks. </P> <P>First break would be the Real Servers Info component, and it goes something like this:</P> <PRE><CODE>Real Servers Info ======================== State - ACT:active, ENB:enabled, FAL:failed, TST:test, SUS:suspect, GDN:grace-dn, DIS:disabled, UNK:unknown, UNB:unbind, AWU:await-unbind, AWD: await-shutdown </CODE></PRE> <P>Second break onwards will be denoted by the Name: Realserver1, Name: Realserver2 etc.</P> <PRE><CODE> Name: Realservr1 State: Active IP:192.168.88.215: 1 Mac: 000c.2957.46a5 Weight: 1/1 MaxConn: 2000000 SrcNAT: not-cfg, not-op DstNAT: not-cfg, not-op Serv-Rsts: 0 Port St Ms CurConn TotConn Rx-pkts Tx-pkts Rx-octet Tx-octet Reas ---- -- -- ------- ------- ------- ------- -------- -------- ---- default UNB 0 0 0 0 0 0 0 0 http FAL 0 0 0 0 0 0 0 0 Server Total 0 0 0 0 0 0 0 </CODE></PRE> <P>My props looks something like:</P> <PRE><CODE>BREAK_ONLY_BEFORE = Name: MUST_BREAK_AFTER = telnet@ServerIronADX 1000# </CODE></PRE> <P>I think this is working, and I am able to multikv and report correctly.</P> Fri, 07 Jan 2011 13:06:14 GMT twkan 2011-01-07T13:06:14Z https://community.splunk.com/t5/Splunk-Dev/Multikvs-on-Multiple-Lines/m-p/20899#M194 <P>Hi everybody,</P> <P>I have a piece of log that goes like the below as a single event.</P> <P>Basically these are the statistics for 3 of the virtual servers, namely <STRONG>RealServer1</STRONG>, <STRONG>RealServer2</STRONG> and <STRONG>RealServer3</STRONG>.</P> <P>Question - I want to have a query that allows me to print on information such as the TotConn, Rx-pkts, Tx-pkts etc. for <STRONG>RealServer3</STRONG></P> <P>In this case, how can I refine my search such that when I apply multikv on the results, I am only applying it to RealServer3, and not to the rest of the virtual servers. </P> <P>I tried to do a search e.g.</P> <PRE><CODE>sourcetype=virtuallogs "Name: RealServer3" | multikv </CODE></PRE> <P>But multikv in this case will also give me the results from RealServer1 and RealServer2 which is not what I wanted.</P> <P>Thanks for any inputs again.</P> <PRE><CODE>Real Servers Info ======================== State - ACT:active, ENB:enabled, FAL:failed, TST:test, SUS:suspect, GDN:grace-dn, DIS:disabled, UNK:unknown, UNB:unbind, AWU:await-unbind, AWD: await-shutdown Name: RealServer1 State: Enabled IP:192.168.1.100: 1 Mac: Unknown Weight: 1/1 MaxConn: 2000000 SrcNAT: not-cfg, not-op DstNAT: not-cfg, not-op Serv-Rsts: 0 Port St Ms CurConn TotConn Rx-pkts Tx-pkts Rx-octet Tx-octet Reas ---- -- -- ------- ------- ------- ------- -------- -------- ---- default UNB 0 0 0 0 0 0 0 0 514 ENB 0 0 0 0 0 0 0 0 Server Total 0 0 0 0 0 0 0 Name: RealServer2 State: Enabled IP:192.168.1.101: 1 Mac: Unknown Weight: 1/1 MaxConn: 2000000 SrcNAT: not-cfg, not-op DstNAT: not-cfg, not-op Serv-Rsts: 0 Port St Ms CurConn TotConn Rx-pkts Tx-pkts Rx-octet Tx-octet Reas ---- -- -- ------- ------- ------- ------- -------- -------- ---- default UNB 0 0 0 0 0 0 0 0 514 ENB 0 0 0 0 0 0 0 0 Server Total 0 0 0 0 0 0 0 Name: RealServer3 State: Active IP:192.168.88.211: 1 Mac: 000c.29b8.6170 Weight: 1/1 MaxConn: 2000000 SrcNAT: not-cfg, not-op DstNAT: not-cfg, not-op Serv-Rsts: 0 Port St Ms CurConn TotConn Rx-pkts Tx-pkts Rx-octet Tx-octet Reas ---- -- -- ------- ------- ------- ------- -------- -------- ---- default UNB 0 0 0 0 0 0 0 0 http ACT 0 0 6 0 18 0 1164 0 Server Total 0 6 0 18 0 1164 0 </CODE></PRE> Wed, 05 Jan 2011 23:45:15 GMT https://community.splunk.com/t5/Splunk-Dev/Multikvs-on-Multiple-Lines/m-p/20899#M194 silvermail 2011-01-05T23:45:15Z https://community.splunk.com/t5/Splunk-Dev/Multikvs-on-Multiple-Lines/m-p/20900#M195 <P>Okay, I have decided to break the events into several chunks. </P> <P>First break would be the Real Servers Info component, and it goes something like this:</P> <PRE><CODE>Real Servers Info ======================== State - ACT:active, ENB:enabled, FAL:failed, TST:test, SUS:suspect, GDN:grace-dn, DIS:disabled, UNK:unknown, UNB:unbind, AWU:await-unbind, AWD: await-shutdown </CODE></PRE> <P>Second break onwards will be denoted by the Name: Realserver1, Name: Realserver2 etc.</P> <PRE><CODE> Name: Realservr1 State: Active IP:192.168.88.215: 1 Mac: 000c.2957.46a5 Weight: 1/1 MaxConn: 2000000 SrcNAT: not-cfg, not-op DstNAT: not-cfg, not-op Serv-Rsts: 0 Port St Ms CurConn TotConn Rx-pkts Tx-pkts Rx-octet Tx-octet Reas ---- -- -- ------- ------- ------- ------- -------- -------- ---- default UNB 0 0 0 0 0 0 0 0 http FAL 0 0 0 0 0 0 0 0 Server Total 0 0 0 0 0 0 0 </CODE></PRE> <P>My props looks something like:</P> <PRE><CODE>BREAK_ONLY_BEFORE = Name: MUST_BREAK_AFTER = telnet@ServerIronADX 1000# </CODE></PRE> <P>I think this is working, and I am able to multikv and report correctly.</P> Fri, 07 Jan 2011 13:06:14 GMT https://community.splunk.com/t5/Splunk-Dev/Multikvs-on-Multiple-Lines/m-p/20900#M195 twkan 2011-01-07T13:06:14Z