https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444472#M126056 <P>Hi Landen, Thanks for your response.<BR /> Using this I am not able to see _time field. So basically my ultimate goal is to plot 2 charts (line graphs) in same splunk. Now the 2nd chart will consist of this index=os data. So i was thinking of exporting the PID and time values from this splunk to other splunk and then plot the chart against time.<BR /> Does this make sense?</P> Thu, 02 May 2019 08:48:16 GMT Shashank_87 2019-05-02T08:48:16Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444468#M126052 <P>Hi, I have one OS index in Splunk where i get the raw data in a tabular format like below. Now I need to extract these fields like PID and that too only for the "java" COMMAND.</P> <PRE><CODE>PID USER PR NI VIRT RES SHR S pctCPU pctMEM cpuTIME COMMAND 7195 user 20 0 1361m 74m 15m S 25.1 0.3 57:32.41 oneagentos 7240 api 20 0 14.1g 1.9g 35m S 5.8 8.1 62:42.81 java 9717 api 20 0 14.1g 1.8g 35m S 3.9 7.8 61:00.56 java 3882 user1 20 0 1530m 34m 8584 S 1.9 0.1 212:28.61 python </CODE></PRE> <P>I would need this data in a lookup because I need to ingest it into another instance of Splunk to compare the charts.<BR /> Can someone help me extracting these fields and how can i export those to another Splunk?</P> Wed, 01 May 2019 15:12:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444468#M126052 Shashank_87 2019-05-01T15:12:32Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444469#M126053 <P>Use multikv:</P> <PRE><CODE>| stats count | eval _raw="PID USER PR NI VIRT RES SHR S pctCPU pctMEM cpuTIME COMMAND 7195 user 20 0 1361m 74m 15m S 25.1 0.3 57:32.41 oneagentos 7240 api 20 0 14.1g 1.9g 35m S 5.8 8.1 62:42.81 java 9717 api 20 0 14.1g 1.8g 35m S 3.9 7.8 61:00.56 java 3882 user1 20 0 1530m 34m 8584 S 1.9 0.1 212:28.61 python" | table _raw | multikv </CODE></PRE> <P>For your example:</P> <PRE><CODE>index=os | multikv | outputlookup yourlookup.csv </CODE></PRE> Wed, 01 May 2019 15:52:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444469#M126053 landen99 2019-05-01T15:52:31Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444470#M126054 <P>On your 1st instance, you could do something like this to extract pids to a file.</P> <PRE><CODE> index=os | rex field=_raw " ^(?&lt;java_pid&gt;\d+)\s.*java$"| table java_pid | eval status ="java" | fields java_pid, status | outputlookup java_pid_status.csv </CODE></PRE> <P>On the second instance, you can then use this lookup to compare </P> Wed, 01 May 2019 16:23:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444470#M126054 lakshman239 2019-05-01T16:23:16Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444471#M126055 <P>Hi, I dont think this rex is correct as it is not working.</P> Thu, 02 May 2019 08:39:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444471#M126055 Shashank_87 2019-05-02T08:39:32Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444472#M126056 <P>Hi Landen, Thanks for your response.<BR /> Using this I am not able to see _time field. So basically my ultimate goal is to plot 2 charts (line graphs) in same splunk. Now the 2nd chart will consist of this index=os data. So i was thinking of exporting the PID and time values from this splunk to other splunk and then plot the chart against time.<BR /> Does this make sense?</P> Thu, 02 May 2019 08:48:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444472#M126056 Shashank_87 2019-05-02T08:48:16Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444473#M126057 <P>could you pls check now and also review/amend as needed for your event - <A href="https://regex101.com/r/lcAZF0/2">https://regex101.com/r/lcAZF0/2</A></P> Thu, 02 May 2019 09:58:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444473#M126057 lakshman239 2019-05-02T09:58:12Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444474#M126058 <P>The SPL posted was just an example to show the command "multikv" in action. For your data, your SPL would probably like this:</P> <PRE><CODE>index=os | multikv </CODE></PRE> Thu, 02 May 2019 17:18:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444474#M126058 landen99 2019-05-02T17:18:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444475#M126059 <P>It worked thanks.</P> Wed, 08 May 2019 10:26:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multivalue-fields-in-Splunk-and-the-events-in/m-p/444475#M126059 Shashank_87 2019-05-08T10:26:16Z