https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174897#M50194 <P>Hi @ppablo_splunk</P> <P>Thank you for quick response.</P> <P>Am trying to extract the count values from line 9 thru 10. Example, in one of the dashboard I want to show "Total no of Inputs : 14202" and "Status 16 entry: 0".</P> <P>Please let me know for more information.</P> <P>Thanks<BR /> Mugunthan </P> Wed, 11 Mar 2015 19:08:51 GMT muguniya 2015-03-11T19:08:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174895#M50192 <PRE><CODE>-------------------------------------------------------------- | R u n C o n t r o l D i s p l a y | -------------------------------------------------------------- 1. --------------------------------------------------------------- 2. | X X X X X X X X M U L T I - E N G I N E | 3. | Run Control Display Begin | 4. --------------------------------------------------------------- 5. Job Instance ID: XXXXXXXX Total Number of Engines Summarized: 22 6. --------------------------------------------------------------- 7. 8. Description Count 9. Total NO OF Input 14202 10. status 16 0 11. --------------------------------------------------------------- 12. | X X X X X X X X M U L T I - E N G I N E | 13. | Run Control Display End | 14. --------------------------------------------------------------- -------------------------------------------------------------- </CODE></PRE> Wed, 11 Mar 2015 18:25:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174895#M50192 muguniya 2015-03-11T18:25:49Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174896#M50193 <P>Hi @muguniya</P> <P>What exactly do you mean "How to extra the count..." in your title? Can you provide more details what you need help with?</P> Wed, 11 Mar 2015 18:37:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174896#M50193 ppablo 2015-03-11T18:37:42Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174897#M50194 <P>Hi @ppablo_splunk</P> <P>Thank you for quick response.</P> <P>Am trying to extract the count values from line 9 thru 10. Example, in one of the dashboard I want to show "Total no of Inputs : 14202" and "Status 16 entry: 0".</P> <P>Please let me know for more information.</P> <P>Thanks<BR /> Mugunthan </P> Wed, 11 Mar 2015 19:08:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174897#M50194 muguniya 2015-03-11T19:08:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174898#M50195 <P>I think the <CODE>mulikv</CODE> command will help. Assuming the text of your example is a single event, this should extract the fields you seek:</P> <PRE><CODE>... | multikv fields Description Count | table Description Count </CODE></PRE> <P>You may need to add some options to <CODE>multikv</CODE> to help Splunk find the table in your event.</P> Wed, 11 Mar 2015 20:17:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-count-from-below-tabular-form-of-logs/m-p/174898#M50195 richgalloway 2015-03-11T20:17:16Z