topic Multiline event report in Splunk Search

Multiline event report

sarumjanuch — Mon, 04 Nov 2013 15:02:08 GMT

Hi there i have log something like this:

id=4555 event=Enter data1=12
id=4555 event=Connect data1=23
id=4555 event=Exit data1=28
id=4556 event=Enter data1=12
id=4556 event=Connect data1=23
id=4556 event=Exit data1=28

then i use | transaction id

and i receive my events gouped by id, but now, i need to create a table like this:

id | data1 from line where event=Enter | data1 from line whre event=Connect

can someone advise me, what tool i should read about?

Re: Multiline event report

rakesh_498115 — Mon, 04 Nov 2013 15:28:44 GMT

Pls give me the table format..so that i can help with the query ?

Re: Multiline event report

kristian_kolb — Mon, 04 Nov 2013 15:31:56 GMT

You can access the elements of the multi-valued field with the mvindex() function of eval;

your_base_search 
| transaction id 
| eval Enter_Data_1 = mvindex(data1, 0) 
| eval Connect_Data_1 = mvindex(data1,1) 
| table id, Enter_Data_1, Connect_Data_1

output

id     Enter_Data_1      Connect_Data_1
4555   12                23
4556   12                23

Hope this helps,

Re: Multiline event report

lukejadamec — Mon, 04 Nov 2013 15:36:59 GMT

Have you tried limiting the search to events that match that criteria?
Add this prior to the transaction:

|search event="Enter" OR event="Connect" |