https://community.splunk.com/t5/Splunk-Search/Regex-for-SAR-data-in-UNIX/m-p/40612#M9365 <P>Here's a great reference for you with the multikv command:</P> <P><A href="http://blogs.splunk.com/2007/08/23/ripping-mulitline-events-at-seach-time/">http://blogs.splunk.com/2007/08/23/ripping-mulitline-events-at-seach-time/</A></P> <P>Previous answer:</P> <P><A href="http://splunk-base.splunk.com/answers/7352/multikv-field-extraction">http://splunk-base.splunk.com/answers/7352/multikv-field-extraction</A></P> Tue, 20 Nov 2012 18:59:50 GMT sdaniels 2012-11-20T18:59:50Z https://community.splunk.com/t5/Splunk-Search/Regex-for-SAR-data-in-UNIX/m-p/40611#M9364 <P>Hello</P> <P>I need to create a timechart for the data below based on cpu's available and the utilization of that specific cpu. I have a field for pctSystem so that hasn't been an issue. But I don't have a CPU field which I can use in the timechart. Can anyone please tell me what regex needs to be used to obtain vertical data for CPU</P> <P>CPU pctUser pctNice pctSystem pctIowait pctIdle<BR /> 0 51 ? 21 0 28<BR /> 1 55 ? 19 0 25<BR /> all 53 ? 20 0 26</P> Tue, 20 Nov 2012 18:57:16 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-SAR-data-in-UNIX/m-p/40611#M9364 theouhuios 2012-11-20T18:57:16Z https://community.splunk.com/t5/Splunk-Search/Regex-for-SAR-data-in-UNIX/m-p/40612#M9365 <P>Here's a great reference for you with the multikv command:</P> <P><A href="http://blogs.splunk.com/2007/08/23/ripping-mulitline-events-at-seach-time/">http://blogs.splunk.com/2007/08/23/ripping-mulitline-events-at-seach-time/</A></P> <P>Previous answer:</P> <P><A href="http://splunk-base.splunk.com/answers/7352/multikv-field-extraction">http://splunk-base.splunk.com/answers/7352/multikv-field-extraction</A></P> Tue, 20 Nov 2012 18:59:50 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-SAR-data-in-UNIX/m-p/40612#M9365 sdaniels 2012-11-20T18:59:50Z