https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176628#M50738 <PRE><CODE>04/07/15 23:55:01 Device: a b c d e f g h i j k 1ppd 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 2ppc 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 3ppb 0.00 5.00 0.00 1.00 0.00 24.00 41.00 0.00 2.00 1.00 0.80 </CODE></PRE> <P>It's a .log file, so it's not so structured hence uncommon to be parsed.<BR /> However, I'm desperately looking for ways to extract, say, column j and k from this log file and table it using Splunk.<BR /> I would appreciate any kind of input.</P> <P>Thank you in advance,<BR /> Best,<BR /> Jack</P> Thu, 25 Jun 2015 19:41:05 GMT minkyuk 2015-06-25T19:41:05Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176628#M50738 <PRE><CODE>04/07/15 23:55:01 Device: a b c d e f g h i j k 1ppd 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 2ppc 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 3ppb 0.00 5.00 0.00 1.00 0.00 24.00 41.00 0.00 2.00 1.00 0.80 </CODE></PRE> <P>It's a .log file, so it's not so structured hence uncommon to be parsed.<BR /> However, I'm desperately looking for ways to extract, say, column j and k from this log file and table it using Splunk.<BR /> I would appreciate any kind of input.</P> <P>Thank you in advance,<BR /> Best,<BR /> Jack</P> Thu, 25 Jun 2015 19:41:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176628#M50738 minkyuk 2015-06-25T19:41:05Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176629#M50739 <P>Have you tried reading up on Field Extractions in Splunk?<BR /> Ref: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX">http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX</A></P> <P>You can also specify transforms for your data ( transforms.conf + props.conf)<BR /> Ref: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles</A></P> Thu, 25 Jun 2015 21:12:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176629#M50739 sk314 2015-06-25T21:12:06Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176630#M50740 <P>Well, I think semantically I'd argue that this data is indeed structured. That said, more detail is probably needed on the nature of what the row headings (1ppd, 1ppc, etc) and values (0.00, 5.00) represent before we can decide how best to parse this data.</P> Thu, 25 Jun 2015 21:36:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176630#M50740 rkent 2015-06-25T21:36:54Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176631#M50741 <P><CODE>multikv</CODE> has been developed for this kind of table-ish source: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/multikv">http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/multikv</A></P> <PRE><CODE>base search | multikv | ... </CODE></PRE> Fri, 26 Jun 2015 09:29:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-and-extract-unstructured-log-file-data-in-Splunk/m-p/176631#M50741 martin_mueller 2015-06-26T09:29:46Z