All Apps and Add-ons

multikv not extracting table

SapthagiriAavik
Explorer

i have a unix system log information as tables in events.every event have 4 column and 10 rows. i want to extract all the row information in to 4 fields. but header and value row structure is different, i tried multikv with noheader/force header and regex still im not able get desired result.

Table Structure
.......\s...........\s................\s............\s...... (Header row of Table) separator: space
.......\t...........\t................\t............\t...... (Rest of the rows in Table) separator: tab

CPU pctUser PctSystem pctIowait pctIdle
0 32 62 0 6
2 52 82 0 7
...
...

while using noheader=true , i'm getting only second row of each table.

Is there any way to get all of the row info to corresponding field.

0 Karma

sdchakraborty
Contributor

Hi,
Can you please add multikv.conf file with below stanza in $SPLUNK_HOME/etc/system/local/ directory and run the search provided below,

[tab_mkv]
header.start = "CPU"
header.linecount = 1
header.tokens = _tokenize_, -1," "
body.tokens = _tokenize_,-1, "  "

index=<index name> | multikv conf=tab_mkv
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...