topic Re: How do I extract fields in line separated data without key-value pair? in Splunk Search

How do I extract fields in line separated data without key-value pair?

melonman — Thu, 05 Jan 2012 13:37:26 GMT

Hi,

I have a logfile containing data that looks like the below:

Nov 21 13:59:41
hostname1
data1
data2
data3
Nov 21 13:59:42
hostname1
data1
data2
data3
Nov 21 13:59:43
hostname1
data1
data2
data3

I would like to extract hostname, and each data in a separate line.
How can I configure the regex to get such fields?

Thanks in advance,

Re: How do I extract fields in line separated data without key-value pair?

sbrant_tt — Thu, 05 Jan 2012 23:51:13 GMT

Splunk should already parse out each section, splitting on the timestamp, to a separate "record". This regex will work for the sample you've provided:

rex "(?m)(?.+)\n(?.+)\n(?.+)\n(?.+)\n(?.*+)"

Re: How do I extract fields in line separated data without key-value pair?

melonman — Fri, 06 Jan 2012 08:33:29 GMT

That's great, thanks!