topic Re: mutlivalue text into real table in Splunk Search

mutlivalue text into real table

duncanzhang1 — Fri, 04 Jul 2025 19:56:32 GMT

I have a log events that looks like this...

"name|fname|desc|group|cat|exp|set|in abc|abc||Administrators;Users|S||1|1 bbb|bbb|Internal||N||2|2
ccc|ccc|MFT Service ID|Administrators;Users|S||3|3"

the log event's text is delimited by 6 spaces...

What splunk query do I use to create splunk table like this

name	fname	desc	group	cat	exp	set	in
abc	abc		Administrators;Users	S		1	1
bbb	bbb	Interna		N		2	2
ccc	ccc	MFT Service ID	Administrators;Users	S		3	3

Re: mutlivalue text into real table

PickleRick — Fri, 04 Jul 2025 20:15:03 GMT

Table is just a method of visualizing data. You need to parse your data into fields.

So the question is what the real data looks like (please copy-paste the raw event into a code block or a preformatted paragraph) and what it means. For now you have a lot of pipe-delimited "fields" but no way of knowing which of them are the "header", which are "data" and how many of "data" rows are there.

Re: mutlivalue text into real table

yuanliu — Sat, 05 Jul 2025 04:33:34 GMT

Agree with @PickleRick that you need to clearly demonstrate raw data because the I don't think your raw log looks like what you show. Is it more like the following?

name|fname|desc|group|cat|exp|set|in abc|abc||Administrators;Users|S||1|1 bbb|bbb|Internal||N||2|2 ccc|ccc|MFT Service ID|Administrators;Users|S||3|3

In other words, it is multiline pipe (|) delimited text with a header line. (Like default table list from many SQL DBMS's.) The format shown in your original description cannot be reliably processed.

If my speculation about your raw data is correct, you first change delimiter to comma, then use multikv to extract from the table, like this:

| rex mode=sed "s/\|/,/g" | multikv forceheader=1 | table name fname desc group cat exp set in

Here is an emulation for you to play with and compare with real data:

| makeresults | fields - _time | eval _raw = "name|fname|desc|group|cat|exp|set|in abc|abc||Administrators;Users|S||1|1 bbb|bbb|Internal||N||2|2 ccc|ccc|MFT Service ID|Administrators;Users|S||3|3" ``` data emulation above ```

Output from this emulation is

name	fname	desc	group	cat	exp	set	in
abc	abc		Administrators;Users	S		1	1
bbb	bbb	Internal		N		2	2
ccc	ccc	MFT Service ID	Administrators;Users	S		3	3