topic Re: How to read and extract table format logs in splunk? in Splunk Search

How to read and extract table format logs in Splunk?

karthi2809 — Thu, 30 Mar 2023 07:36:07 GMT

Thanks in Advance,

How to read and extract table format logs in splunk?

And i need DeviceID as field and with values as same for all fields

3/29/23
4:56:34.000 AM

29-Mar-2023 04:56:34:PM: |Application Disk Space utilization %

DeviceID VolumeName FreeSpace (Gb) Total (Gb) FreePercent

-------- ---------- -------------- ---------- -----------

C: System 389.45 475.14 81.97

P: Offline 389.45 475.14 81.97

3/29/23
4:56:34.000 AM

29-Mar-2023 04:56:34:PM: |Services Status in Server

Status Name DisplayName

------ ---- -----------

Stopped ALG Application Layer Gateway Service Running

Running Appinfo Application Information

Re: How to read and extract table format logs in splunk?

gcusello — Thu, 30 Mar 2023 06:55:21 GMT

Hi @karthi2809,

probably the solution could be kvform command (https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Kvform).

Could you share some sample of your data?

Ciao.

Giuseppe

Re: How to read and extract table format logs in splunk?

karthi2809 — Fri, 31 Mar 2023 02:36:48 GMT

Hi @gcusello This is my log file and i onboarded data in splunk

29-Mar-2023 04:56:34:PM: |Services Status in Server Status Name DisplayName ------ ---- ----------- Stopped ALG Application Layer Gateway Service Running Appinfo Application Information 29-Mar-2023 04:56:34:PM: |Application Disk Space utilization % DeviceID VolumeName FreeSpace (Gb) Total (Gb) FreePercent -------- ---------- -------------- ---------- ----------- C: System 389.45 475.14 81.97 P: Offline 389.45 475.14 81.97 29-Mar-2023 04:56:34:PM: |Application Running Process Status Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName ------- ------ ----- ----- ------ -- -- ----------- 1376 54 175332 238112 3,296.30 7516 4 Teams 9558 194 510488 458660 2,687.58 16488 4 OUTLOOK 926 47 46352 60284 1,959.77 2124 4 cptrayUI 1312 48 232896 175384 1,427.73 2684 4 msedge 3473 560 163948 282908 1,234.33 14368 4 msedge 29-Mar-2023 04:56:35:PM: |CPU Utilization % Average ------- 11 29-Mar-2023 04:56:36:PM: |Memory Utilization % MemoryUsage % ------------- 61.44 29-Mar-2023 04:56:36:PM: |Path Installed on System in Last 90 days Source Description HotFixID InstalledBy InstalledOn ------ ----------- -------- ----------- ----------- Update KB NT AUTHORITY\SYSTEM 16/02/2023 12:00:00 AM Security Update KB NT AUTHORITY\SYSTEM 23/03/2023 12:00:00 AM Update KB NT AUTHORITY\SYSTEM 23/03/2023 12:00:00 AM