topic Re: Read Table in Splunk Search

Read Table

HansK — Fri, 12 Sep 2014 09:37:22 GMT

Hi, I'm trying to get the data from below image into a usable format, I would like to end up with key-value pairs like:

INCATOT=26258
TRU=86167
ACCCONG=0
PRERTEAB=20
etc ...

I do not know how to describe the datastructure we are receiving as it is a table but with muliple headers in a column.

Re: Read Table

tom_frotscher — Fri, 12 Sep 2014 13:27:39 GMT

FYI: There was a Question regarding the same tableformat as you have here. Also parts of the table header are the same: Link

If your headers are fixed, you might be able to solve this with regular expressions.

Re: Read Table

HansK — Fri, 19 Sep 2014 12:13:31 GMT

For future refence, this is the regex to solve the extraction:

    [\n\r].*--\s*(?<INCATOT>[0-9]*)\s*(?<PRERTEAB>[0-9]*)\s*(?<INFAIL>[0-9]*)\s*(?<NATTMPT>[0-9]*)\s*(?<NOVFLATB>[0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)