topic Re: regex need help separating each row and creating fields in Dashboards & Visualizations https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679065#M55627 <P>You could do that with a search command like this:</P><P><STRONG>| search NOT "aggregation"</STRONG><BR /><BR />Or<BR /><BR /><STRONG>| search id=*</STRONG></P> Wed, 28 Feb 2024 21:53:21 GMT jotne 2024-02-28T21:53:21Z regex need help separating each row and creating fields https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679031#M55621 <P>&nbsp;</P><P>Hi i would like some help to extract each line of data into separate fields of Name, ID, Speed &amp; duplex, state, mac address.</P><P>critical that "state" is its own field.</P><P>getting stuck and need help. thank you</P><P>Data below</P><P>&nbsp;</P><TABLE width="502"><TBODY><TR><TD width="502">name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; id&nbsp;&nbsp;&nbsp; speed/duplex/state&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mac address&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />--------------------------------------------------------------------------------<BR />ethernet1/3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 66&nbsp;&nbsp;&nbsp; 1000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:42<BR />ethernet1/4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 67&nbsp;&nbsp;&nbsp; 1000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:43<BR />ethernet1/5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 68&nbsp;&nbsp;&nbsp; 10000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:44<BR />ethernet1/6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69&nbsp;&nbsp;&nbsp; 10000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:45<BR />ethernet1/7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 70&nbsp;&nbsp;&nbsp; 10000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:46<BR />ethernet1/8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 71&nbsp;&nbsp;&nbsp; 10000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:47<BR />ae1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 16&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:10<BR />ae2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:11<BR />ha1-a&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp; 1000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; d1:f4:b3:c3:25:97<BR />ha1-b&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp; 1000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; d1:f4:b3:c3:25:96<BR />vlan&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:01<BR />loopback&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:03<BR />tunnel&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4&nbsp;&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:04<BR />hsci&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp; 40000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 01:20:6c:1c:81:08&nbsp;</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>any help will be appreciated. thanks,&nbsp;</P> Wed, 28 Feb 2024 16:42:17 GMT https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679031#M55621 thaghost99 2024-02-28T16:42:17Z Re: regex need help separating each row and creating fields https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679038#M55622 <P>Here you go:</P><LI-CODE lang="markup">(?&lt;name&gt;\S+)\s+(?&lt;id&gt;\d+)\s+(?&lt;speed&gt;[^\/]+)\/(?&lt;duplex&gt;[^\/]+)\/(?&lt;state&gt;\S+)\s+(?&lt;mac&gt;\S+)</LI-CODE><P><A href="https://regex101.com/r/99K6Do/1" target="_blank">https://regex101.com/r/99K6Do/1</A></P> Wed, 28 Feb 2024 17:17:43 GMT https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679038#M55622 jotne 2024-02-28T17:17:43Z Re: regex need help separating each row and creating fields https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679040#M55623 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213488">@jotne</a>&nbsp;it works great, just small favor. how do i stop it if it sees the below line 'aggregation groups'? with data below? cause its also capturing that part, but the rest is great. ty</P><TABLE width="502"><TBODY><TR><TD width="502">name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; id&nbsp;&nbsp;&nbsp; speed/duplex/state&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mac address&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />--------------------------------------------------------------------------------<BR />ethernet1/3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 66&nbsp;&nbsp;&nbsp; 1000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:42<BR />ethernet1/4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 67&nbsp;&nbsp;&nbsp; 1000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:43<BR />ethernet1/5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 68&nbsp;&nbsp;&nbsp; 10000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:44<BR />ethernet1/6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69&nbsp;&nbsp;&nbsp; 10000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:45<BR />ethernet1/7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 70&nbsp;&nbsp;&nbsp; 10000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:46<BR />ethernet1/8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 71&nbsp;&nbsp;&nbsp; 10000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:47<BR />ae1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 16&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:10<BR />ae2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:11<BR />ha1-a&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp; 1000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; d1:f4:b3:c3:25:97<BR />ha1-b&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp; 1000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; d1:f4:b3:c3:25:96<BR />vlan&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:01<BR />loopback&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:03<BR />tunnel&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4&nbsp;&nbsp;&nbsp;&nbsp; [n/a]/[n/a]/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b6:2c:23:e0:40:04<BR />hsci&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp; 40000/full/up&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 01:20:6c:1c:81:08<BR /><BR /><BR />aggregation groups: 0</TD></TR></TBODY></TABLE> Wed, 28 Feb 2024 17:42:38 GMT https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679040#M55623 thaghost99 2024-02-28T17:42:38Z Re: regex need help separating each row and creating fields https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679041#M55624 <P>Does it have to be regex?&nbsp; I'm a big fan of them, but this problem looks like it's made for <FONT face="courier new,courier">multikv</FONT>.</P> Wed, 28 Feb 2024 17:54:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679041#M55624 richgalloway 2024-02-28T17:54:46Z Re: regex need help separating each row and creating fields https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679042#M55625 <P>no it does not have to be. its whatever works. <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span></P> Wed, 28 Feb 2024 17:56:12 GMT https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679042#M55625 thaghost99 2024-02-28T17:56:12Z Re: regex need help separating each row and creating fields https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679060#M55626 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;</P><P>hi Rich are you able to do multikv help on this one?</P> Wed, 28 Feb 2024 21:22:43 GMT https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679060#M55626 thaghost99 2024-02-28T21:22:43Z Re: regex need help separating each row and creating fields https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679065#M55627 <P>You could do that with a search command like this:</P><P><STRONG>| search NOT "aggregation"</STRONG><BR /><BR />Or<BR /><BR /><STRONG>| search id=*</STRONG></P> Wed, 28 Feb 2024 21:53:21 GMT https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679065#M55627 jotne 2024-02-28T21:53:21Z Re: regex need help separating each row and creating fields https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679114#M55631 <P>Yes, I can help, but it's also in the manual.</P><LI-CODE lang="markup">| multikv forceheader=1</LI-CODE> Thu, 29 Feb 2024 13:04:49 GMT https://community.splunk.com/t5/Dashboards-Visualizations/regex-need-help-separating-each-row-and-creating-fields/m-p/679114#M55631 richgalloway 2024-02-29T13:04:49Z