topic How to extract all fields like DISK? in Splunk Search

How to extract all fields like DISK?

ranjithan — Wed, 23 Feb 2022 18:41:05 GMT

----------------------- DISK INFORMATION ----------------------------

DISK="/dev/sda" NAME="sda" HCTL="0:0:0:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="0" CHANNEL="0" ID="0" LUN="0" BOOTDISK="TRUE" DISK="/dev/sdb" NAME="sdb" HCTL="0:0:0:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="0" CHANNEL="0" ID="0" LUN="1" BOOTDISK="FALSE" DISK="/dev/sdc" NAME="sdc" HCTL="0:0:1:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="0" CHANNEL="0" ID="1" LUN="0" BOOTDISK="TRUE" DISK="/dev/sdd" NAME="sdd" HCTL="0:0:1:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="0" CHANNEL="0" ID="1" LUN="1" BOOTDISK="FALSE" DISK="/dev/sde" NAME="sde" HCTL="7:0:0:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="7" CHANNEL="0" ID="0" LUN="0" BOOTDISK="TRUE" DISK="/dev/sdf" NAME="sdf" HCTL="7:0:0:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="7" CHANNEL="0" ID="0" LUN="1" BOOTDISK="FALSE" DISK="/dev/sdg" NAME="sdg" HCTL="7:0:1:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="7" CHANNEL="0" ID="1" LUN="0" BOOTDISK="TRUE" DISK="/dev/sdh" NAME="sdh" HCTL="7:0:1:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="7" CHANNEL="0" ID="1" LUN="1" BOOTDISK="FALSE"

My multiline event log looks like this in Splunk. Could someone please help me extract all the fields like DISK, NAME, HCTL TYPE, VENDOR, SIZE using SPL...

Re: Field extraction

gcusello — Wed, 23 Feb 2022 12:21:24 GMT

Hi @ranjithan,

my previous answer isn't ok for your needs?

https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values/m-p/586203#M204196

the above regex extracts all the fields from your new logs.

Ciao.

Giuseppe

Re: Field extraction

ITWhisperer — Wed, 23 Feb 2022 12:56:49 GMT

First you need to split the event(s) into separate lines (I have added a row count so you can keep track of the original event if that's important to you). Then extract the name/value pairs. Then create fields based on the names, with their corresponding values. Finally, join the fields together based on which line they came from.

| makeresults count=2 | streamstats count as row | eval _raw="----------------------- DISK INFORMATION ---------------------------- DISK=\"/dev/sda\" NAME=\"sda\" HCTL=\"0:0:0:0\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"120G\" SCSIHOST=\"0\" CHANNEL=\"0\" ID=\"0\" LUN=\"0\" BOOTDISK=\"TRUE\" DISK=\"/dev/sdb\" NAME=\"sdb\" HCTL=\"0:0:0:1\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"300G\" SCSIHOST=\"0\" CHANNEL=\"0\" ID=\"0\" LUN=\"1\" BOOTDISK=\"FALSE\" DISK=\"/dev/sdc\" NAME=\"sdc\" HCTL=\"0:0:1:0\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"120G\" SCSIHOST=\"0\" CHANNEL=\"0\" ID=\"1\" LUN=\"0\" BOOTDISK=\"TRUE\" DISK=\"/dev/sdd\" NAME=\"sdd\" HCTL=\"0:0:1:1\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"300G\" SCSIHOST=\"0\" CHANNEL=\"0\" ID=\"1\" LUN=\"1\" BOOTDISK=\"FALSE\" DISK=\"/dev/sde\" NAME=\"sde\" HCTL=\"7:0:0:0\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"120G\" SCSIHOST=\"7\" CHANNEL=\"0\" ID=\"0\" LUN=\"0\" BOOTDISK=\"TRUE\" DISK=\"/dev/sdf\" NAME=\"sdf\" HCTL=\"7:0:0:1\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"300G\" SCSIHOST=\"7\" CHANNEL=\"0\" ID=\"0\" LUN=\"1\" BOOTDISK=\"FALSE\" DISK=\"/dev/sdg\" NAME=\"sdg\" HCTL=\"7:0:1:0\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"120G\" SCSIHOST=\"7\" CHANNEL=\"0\" ID=\"1\" LUN=\"0\" BOOTDISK=\"TRUE\" DISK=\"/dev/sdh\" NAME=\"sdh\" HCTL=\"7:0:1:1\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"300G\" SCSIHOST=\"7\" CHANNEL=\"0\" ID=\"1\" LUN=\"1\" BOOTDISK=\"FALSE\"" | multikv forceheader=1 | fields _raw row | rex max_match=0 "(?<namevalue>\S+=\"[^\"]+\")" | streamstats count as _row | mvexpand namevalue | rex field=namevalue "(?<_name>\S+)=\"(?<_value>[^\"]+)\"" | fields - namevalue | eval {_name}=_value | stats values(*) as * by row _row

Re: Field extraction

ranjithan — Wed, 23 Feb 2022 13:04:59 GMT

This works, thank you so much Giuseppe

Re: Field extraction

gcusello — Wed, 23 Feb 2022 13:07:46 GMT

Hi @ranjithan,

if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉