topic Re: multikv - remove unwanted rows from results in Splunk Search

multikv - remove unwanted rows from results

axsolis — Mon, 13 Jan 2014 16:43:45 GMT

Hi, I am successfully using multikv to parse my tabular data. However, my data has row separators and other non-intesting data that I would like to omit from the results. Is there a way to do this?

For example, The original data looks like this:

**This is data for XXXXX**

Heading1 Heading2 Heading3

-------------------------------------------
fieldA1 fieldA2 fieldA3
fieldB1
fieldB2 fieldB3
fieldC1 fieldC2
fieldC3

**This is data for XXXXX**

Heading1 Heading2 Heading3

-------------------------------------------
fieldA1 fieldA2 fieldA3
fieldB1
fieldB2 fieldB3
fieldC1 fieldC2
fieldC3

I obviously want to omit the lines starting with "**" and "--" from the results. How can I do this?

Thanks!

Re: multikv - remove unwanted rows from results

aelliott — Mon, 13 Jan 2014 16:58:26 GMT

You will need a similar solution to this one:
http://answers.splunk.com/answers/34324/how-can-i-not-index-commented-lines-from-my-files

Re: multikv - remove unwanted rows from results

aelliott — Mon, 13 Jan 2014 17:00:02 GMT

with slightly different regex

Re: multikv - remove unwanted rows from results

axsolis — Mon, 13 Jan 2014 17:10:43 GMT

That worked. I just placed the regex command after the multikv and it omitted the lines I wanted from the search. Thanks!

|multikv|regex _raw="^[^(-|\*).*$].*$"

Above I remove lines starting with "-" and "*".