topic Re: how to take multiple lines of single event data automatically in Splunk Search

how to take multiple lines of single event data automatically

prathapkcsc — Sat, 08 Apr 2017 15:48:09 GMT

My event has like this data
ip = 10.60.11.170 , value = 46
ip = 10.60.11.168 , value = 47
ip = 10.60.11.171 , value = 48
ip = 10.60.11.167 , value = 47
for this i wrote a query
| makeresults
| eval allmydata="ip = 10.60.11.170 , value = 46
ip = 10.60.11.168 , value = 47
ip = 10.60.11.171 , value = 48
ip = 10.60.11.167 , value = 47"

by using above queries perfectly am able to read the values.But the problem is every time i need to copy paste the event data. Is there anyway that even data can be read automatically?

Please anyone can help me?
Thanks in advance

Re: how to take multiple lines of single event data automatically

woodcock — Sun, 09 Apr 2017 18:58:25 GMT

Yes, put | outputscsv SomeFileName.csv on the end and then to get it back, start out your search like this:

|inputcsv SomeFileName.csv ...

You can also use a macro:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Macrosconf

Re: how to take multiple lines of single event data automatically

prathapkcsc — Mon, 10 Apr 2017 02:35:52 GMT

Can you elaborate this?
I cannot understand...
Thank you

Re: how to take multiple lines of single event data automatically

prathapkcsc — Tue, 29 Sep 2020 13:37:35 GMT

makeresults
| eval allmydata="ip = 10.60.11.170 , value = 46
ip = 10.60.11.168 , value = 47
ip = 10.60.11.171 , value = 48
ip = 10.60.11.167 , value = 47"
| rex field=allmydata max_match=0 "(?ip = ([\d.]+) , value = (\d+))"
| fields thedata
| mvexpand thedata
| rex field=thedata max_match=0 "ip = (?[\d.]+) , value = (?\d+)"
| table ip value

This is my query...
Wherr can i make changes according to my requirement .

Re: how to take multiple lines of single event data automatically

prathapkcsc — Mon, 10 Apr 2017 02:43:13 GMT

I want to avoid that all event data in eval command

Re: how to take multiple lines of single event data automatically

woodcock — Mon, 10 Apr 2017 03:20:35 GMT

Do this first:

| makeresults 
| eval allmydata="ip = 10.60.11.170 , value = 46::ip = 10.60.11.168 , value = 47::ip = 10.60.11.171 , value = 48::ip = 10.60.11.167 , value = 47"
| makemv delim="::" allmydata
| mvexpand allmydata
| outputcsv allmydata.csv

Then do this:

| inputcsv allmydata.csv

Bob's your uncle!

Re: how to take multiple lines of single event data automatically

prathapkcsc — Mon, 10 Apr 2017 04:41:00 GMT

allmydata="ip = 10.60.11.170 , value = 46::ip = 10.60.11.168 , value = 47::ip = 10.60.11.171 , value = 48::ip = 10.60.11.167 , value = 47"

I dont want to give all this ip,value manually,splunk has to read automatically.

is it possible?

Re: how to take multiple lines of single event data automatically

prathapkcsc — Tue, 29 Sep 2020 13:35:17 GMT

This is my query...
i want to avoid this manual thing everytime
"ip = 10.60.11.170 , value = 46
ip = 10.60.11.168 , value = 47
ip = 10.60.11.171 , value = 48
ip = 10.60.11.167 , value = 47"

is there any possiblity,do let me know?
Thank you

Re: how to take multiple lines of single event data automatically

prathapkcsc — Mon, 10 Apr 2017 04:52:55 GMT

"ip = 10.60.11.170 , value = 46
ip = 10.60.11.168 , value = 47
ip = 10.60.11.171 , value = 48
ip = 10.60.11.167 , value = 47"

I want to avoid this manual thing..
splunk has to read this automatically

Re: how to take multiple lines of single event data automatically

woodcock — Wed, 16 Jan 2019 18:09:06 GMT

Sure, but where are you planning to get the IP data? From a DB? Use DBConnect. From a search? Just do it. The makeresults stuff was just my way of manufacturing it out of thin air.