topic Re: How to split a multi-line _raw to a multivalue with one line of text per element? in Splunk Search

How to split a multi-line _raw to a multivalue with one line of text per element?

jcburley — Thu, 02 Feb 2017 15:57:31 GMT

I've tried inserting eval first_line=mvindex(split(_raw,"\n"),0) in the pipeline, but that doesn't seem to do the trick.

As far as I can tell, "\n" does not actually denote a one-character string that is a newline. How can I do that?

Since I'm trying to discard the remaining lines and am passing the result of the above through a replace() anyway, I first tried a regex (directly on _raw) ending with (?:\n|.)* as recommended elsewhere, but that didn't work.

At least with the above, I'm able to extract the desired field and replace the whole thing with just that field (for eval of a new variable) -- though I don't understand why, because when I change my table to emit first_line instead of _raw, it still shows up with the subsequent, unwanted, lines.

Re: How to split a multi-line _raw to a multivalue with one line of text per element?

somesoni2 — Thu, 02 Feb 2017 17:10:21 GMT

Give this a try

*Updated regex from \n+ to `\n` **

your base search | rex max_match=0 "^(?<lines>.+)\n+" | eval first_line=mvindex(lines,0) | fields - lines

Re: How to split a multi-line _raw to a multivalue with one line of text per element?

jcburley — Thu, 02 Feb 2017 17:37:12 GMT

Mostly worked, except sometimes there's only one line of trace, leading to no matches and blank lines as a result.

Replacing \n+ with \n* solved that problem.

Thanks! (I'd still like to know why my other approaches didn't work, but at least I've got a working query....)

Re: How to split a multi-line _raw to a multivalue with one line of text per element?

somesoni2 — Thu, 02 Feb 2017 18:38:15 GMT

The thing is the split function excepts string delimiter, and \n is regular expression for line break (your logs will actually not contains char \n), hence it fails. If you want that approach to work, you need to use a replace function to replace, regular expression way, line break with some unique string based on which you can split. Something like this:

eval first_line=mvindex(split(replace(_raw,"\n","#MyLINEBREAK#"),"#MyLINEBREAK#"),0)

Re: How to split a multi-line _raw to a multivalue with one line of text per element?

jcburley — Thu, 02 Feb 2017 19:19:27 GMT

Ah, so the lines in _raw are not actually delimited by \n (NL), but are treated that way for purposes of replace() and so on? Interesting.

Note that I hadn't intended the "\n" to be a "regular expression for line break" but rather the C notation for a string containing NL (newline) as its sole character. I'm still not sure whether Splunk string constants are (even roughly) comparable to C string constants here; maybe that is interpreted as a two-character string consisting of Backslash followed by lower-case n, which would make sense since, otherwise, we'd have to double-up backslashes in replace() et al.

(In languages like Fortran, there are functions that can compose strings having unprintable characters. E.g. CHAR(10) would result in something quite similar to '\n' in C. I couldn't find comparable functions in the Splunk reference....)

Anyway, with the regex you posted updated (the old version still shows up, but your "Updated regex from..." message clarifies things), your answer works, thanks again!

Re: How to split a multi-line _raw to a multivalue with one line of text per element?

edoardo_vicendo — Tue, 12 Mar 2019 16:00:04 GMT

Ciao,

Thanks for the tips reported in this discussion!
I was looking for a way, when you run a search, to split in new lines the _raw fields when you click on "Statistic" tab in order to have it displayed like in "Events" tab

I have done in this way:

your base search | rex max_match=0 "^(?<lines>.+)\n+" | eval raw2=mvindex(lines,0,-1) | table raw2

Best Regards,
Edoardo