https://community.splunk.com/t5/Splunk-Search/Multiline-table-processing/m-p/12762#M1074 <P>Lowell,</P> <P>Thanks, your are right multikv may be the place to start, wihch give me an idea to make it work for multikv. Reformating it, so it's multikv friendly</P> <P>KEY(C7_LINKSET_NUMBER) INFO(C7LINK_OMINFO) C7MSUTX C7MSUTX2 C7MSURX C7MSURX2 C7BYTTX C7BYTTX2 C7BYTRX C7BYTRX2 C7BYTRT C7BYTRT2 C7MSUDSC C7ONSET1 C7ONSET2 C7ONSET3 C7ONSETV C7ABATE1 C7ABATE2 C7ABATE3 C7ABATEV C7MSUDC1 C7MSUDC2 C7MSUDC3 C7STRET C7MSBRET C7MSGLOS C7MSGMSQ C7MSUOR C7MSUOR2 C7MSUTE C7MSUTE2 C7MSUTS C7MSUTS2 0 </P> <P>CP1_LS 0 4582 0 3493 0 1783 1 16130 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 0 4583 0 3492 0 0 0 1 </P> <P>CP1_LS 1 4800 0 3525 0 7121 1 17754 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 0 4800 0 3524 0 0 0</P> <P>Like that and do multikv.</P> Sun, 16 May 2010 22:12:13 GMT clyde772 2010-05-16T22:12:13Z https://community.splunk.com/t5/Splunk-Search/Multiline-table-processing/m-p/12760#M1072 <P>How can I process tables like below where Data is spread across multiple lines. and Top start set defines Field name and a data set starts with "0 CP1_LS" and the next set beibg "1 CP1_LS" and so on. This by the way is a data-set that gets produced every 30 min.</P> <PRE><CODE> TABLE LABEL : KEY (C7_LINKSET_NUMBER) INFO (C7LINK_OMINFO) C7MSUTX C7MSUTX2 C7MSURX C7MSURX2 C7BYTTX C7BYTTX2 C7BYTRX C7BYTRX2 C7BYTRT C7BYTRT2 C7MSUDSC C7ONSET1 C7ONSET2 C7ONSET3 C7ONSETV C7ABATE1 C7ABATE2 C7ABATE3 C7ABATEV C7MSUDC1 C7MSUDC2 C7MSUDC3 C7STRET C7MSBRET C7MSGLOS C7MSGMSQ C7MSUOR C7MSUOR2 C7MSUTE C7MSUTE2 C7MSUTS C7MSUTS2 0 CP1_LS 0 4582 0 3493 0 1783 1 16130 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 0 4583 0 3492 0 0 0 1 CP1_LS 1 4800 0 3525 0 7121 1 17754 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 0 4800 0 3524 0 0 0 2 CP6_LS 0 5760 0 4890 0 1088 2 15420 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 0 5762 0 4889 0 0 0 3 CP2_LS 0 7367 0 5320 0 31485 2 58433 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 0 7366 0 5324 0 0 0 </CODE></PRE> <P>So from the above data set, I want to be able to timechart "C7BYTTX" by "CP6_LS" element.</P> Mon, 03 May 2010 15:23:51 GMT https://community.splunk.com/t5/Splunk-Search/Multiline-table-processing/m-p/12760#M1072 clyde772 2010-05-03T15:23:51Z https://community.splunk.com/t5/Splunk-Search/Multiline-table-processing/m-p/12761#M1073 <P>Any luck with <CODE>mulitkv</CODE>? I think this seems to complicated, but that's probably the best place to start.</P> Fri, 14 May 2010 21:16:53 GMT https://community.splunk.com/t5/Splunk-Search/Multiline-table-processing/m-p/12761#M1073 Lowell 2010-05-14T21:16:53Z https://community.splunk.com/t5/Splunk-Search/Multiline-table-processing/m-p/12762#M1074 <P>Lowell,</P> <P>Thanks, your are right multikv may be the place to start, wihch give me an idea to make it work for multikv. Reformating it, so it's multikv friendly</P> <P>KEY(C7_LINKSET_NUMBER) INFO(C7LINK_OMINFO) C7MSUTX C7MSUTX2 C7MSURX C7MSURX2 C7BYTTX C7BYTTX2 C7BYTRX C7BYTRX2 C7BYTRT C7BYTRT2 C7MSUDSC C7ONSET1 C7ONSET2 C7ONSET3 C7ONSETV C7ABATE1 C7ABATE2 C7ABATE3 C7ABATEV C7MSUDC1 C7MSUDC2 C7MSUDC3 C7STRET C7MSBRET C7MSGLOS C7MSGMSQ C7MSUOR C7MSUOR2 C7MSUTE C7MSUTE2 C7MSUTS C7MSUTS2 0 </P> <P>CP1_LS 0 4582 0 3493 0 1783 1 16130 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 0 4583 0 3492 0 0 0 1 </P> <P>CP1_LS 1 4800 0 3525 0 7121 1 17754 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 0 4800 0 3524 0 0 0</P> <P>Like that and do multikv.</P> Sun, 16 May 2010 22:12:13 GMT https://community.splunk.com/t5/Splunk-Search/Multiline-table-processing/m-p/12762#M1074 clyde772 2010-05-16T22:12:13Z