topic Re: How to split a field having multiple lines into individual lines and finally display in table format in Splunk Search

How to split a field having multiple lines into individual lines and finally display in table format

Splunk_sid — Wed, 06 Sep 2023 07:23:11 GMT

I have field in the event which has multi-line data (between double quotes) and I need to split them into individual lines and finally extract them into a table format for each of the header. Basically, the requirement is to report this data in table format to users.

output = "DbName|CurrentSizeGB|UsedSpaceGB|FreeSpaceGB|ExtractedDate
abc|60.738|39.844|20.894|Sep 5 2023 10:00AM
def|0.098|0.017|0.081|Sep 5 2023 10:00AM
pqr|15.859|0.534|15.325|Sep 5 2023 10:00AM
xyz|32.733|0.675|32.058|Sep 5 2023 10:00AM"

Re: How to split a field having multiple lines into individual lines and finally display in table format

yuanliu — Wed, 06 Sep 2023 07:41:43 GMT

The command is called multikv.

Re: How to split a field having multiple lines into individual lines and finally display in table format

Splunk_sid — Wed, 06 Sep 2023 08:59:07 GMT

@yuanliu - Its not working for this requirement. I see its returning entire output field value multiple times (equal to number of lines in the field.)

Re: How to split a field having multiple lines into individual lines and finally display in table format

yuanliu — Thu, 07 Sep 2023 06:54:42 GMT

Its not working for this requirement. I see its returning entire output field value multiple times (equal to number of lines in the field.)

Note "not working" is about the least informative phrase in the best of scenarios as it conveys virtually no information. Yes, the original output field is expected to be attached to each row. If you don't want to see that, filter it out.

| eval _raw = replace(output, "\|", ",") | multikv | fields - _* linecount output

The real question is: are fields DbName, CurrentSizeGB, etc., extracted? (Each row is its own event. If you want multivalued fields in instead, you can do some stats.) Here is an emulation that you can play with and compare with real data:

| makeresults | eval output = "DbName|CurrentSizeGB|UsedSpaceGB|FreeSpaceGB|ExtractedDate abc|60.738|39.844|20.894|Sep 5 2023 10:00AM def|0.098|0.017|0.081|Sep 5 2023 10:00AM pqr|15.859|0.534|15.325|Sep 5 2023 10:00AM xyz|32.733|0.675|32.058|Sep 5 2023 10:00AM" ``` data emulation above ```

The above emulated input combined with the search gives

CurrentSizeGB	DbName	ExtractedDate	FreeSpaceGB	UsedSpaceGB
60.738	abc	Sep 5 2023 10:00AM	20.894	39.844
0.098	def	Sep 5 2023 10:00AM	0.081	0.017
15.859	pqr	Sep 5 2023 10:00AM	15.325	0.534
32.733	xyz	Sep 5 2023 10:00AM	32.058	0.675

If these fields are not extracted as expected, you need to illustrate your original data more precisely so volunteers can help diagnose. (Anonymous as needed.) In addition, illustration of actual output will also be helpful instead of a useless phrase like "not working".