Getting Data In

How do you parse multiline key value events?

Motivator

How do you parse the below events?

The events looks like :

2018-12-04 01:51:08.330, LogDate="2018-12-04 01:51:08.33", SessionId="abc", MachineName="xyz", LoggerName="def", LogLevel="DEBUG", MessageId="DumpCacheNames", Message="def", ApplicationId="fgd", EndpointStack="abc", LogInsertDate="date"

I need to show events as:

 "2018-12-04 01:51:08.330"
 SessionId=abc 
 MachineName=xyz 
 LoggerName=def
 LogLevel=DEBUG
 MessageId=DumpCacheNames
 Message=def
 ApplicationId=fgd
 EndpointStack=abc
 LogInsertDate=date

Thanks !

Tags (2)
0 Karma
1 Solution

Ultra Champion

You want to change the appearance of the raw events, or you want to extract the fields? Based on your example, I'm assuming the first.

Not entirely sure why you'd want to format the raw events, but something like this should work:

in props.conf

[yoursourcetype]
SEDCMD-0split_to_lines = s/,\s/\n/g
SEDCMD-1strip_quotes = s/"//g
SEDCMD-2add_quotes = s/^([^\r\n]+)/"\1"/

Example in the searchbar:

| makeresults 
| eval _raw = "2018-12-04 01:51:08.330, LogDate=\"2018-12-04 01:51:08.33\", SessionId=\"abc\", MachineName=\"xyz\", LoggerName=\"def\", LogLevel=\"DEBUG\", MessageId=\"DumpCacheNames\", Message=\"def\", ApplicationId=\"fgd\", EndpointStack=\"abc\", LogInsertDate=\"date\""
| rex mode=sed "s/, /\n/g"
| rex mode=sed "s/\"//g"
| rex mode=sed "s/^([^\r\n]+)/\"\1\"/"

View solution in original post

0 Karma

Ultra Champion

You want to change the appearance of the raw events, or you want to extract the fields? Based on your example, I'm assuming the first.

Not entirely sure why you'd want to format the raw events, but something like this should work:

in props.conf

[yoursourcetype]
SEDCMD-0split_to_lines = s/,\s/\n/g
SEDCMD-1strip_quotes = s/"//g
SEDCMD-2add_quotes = s/^([^\r\n]+)/"\1"/

Example in the searchbar:

| makeresults 
| eval _raw = "2018-12-04 01:51:08.330, LogDate=\"2018-12-04 01:51:08.33\", SessionId=\"abc\", MachineName=\"xyz\", LoggerName=\"def\", LogLevel=\"DEBUG\", MessageId=\"DumpCacheNames\", Message=\"def\", ApplicationId=\"fgd\", EndpointStack=\"abc\", LogInsertDate=\"date\""
| rex mode=sed "s/, /\n/g"
| rex mode=sed "s/\"//g"
| rex mode=sed "s/^([^\r\n]+)/\"\1\"/"

View solution in original post

0 Karma

Motivator

@FrankVl
Great Buddy. It worked. Thanks 🙂

I want to change the appearance, it is already available in DB connect v1.

0 Karma

Super Champion

Try

...|kv

or in props.conf-

KV_MODE = auto
0 Karma

Motivator

Nup didn't work. Any other suggestion?

0 Karma

Super Champion

i tried with sample data and it is working as expected

| makeresults |eval _raw="\"2018-12-04 01:51:08.330\"
  SessionId=abc 
  MachineName=xyz 
  LoggerName=def
  LogLevel=DEBUG
  MessageId=DumpCacheNames
  Message=def
  ApplicationId=fgd
  EndpointStack=abc
  LogInsertDate=date"| kv
0 Karma

Motivator

Try with this string

2018-12-04 01:51:08.330, LogDate="2018-12-04 01:51:08.33", SessionId="abc", MachineName="xyz", LoggerName="def", LogLevel="DEBUG", MessageId="DumpCacheNames", Message="def", ApplicationId="fgd", EndpointStack="abc", LogInsertDate="date"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!