unable to read field names with space using mulikv

[kanalasreekanth]

From log file , i have mixed data some wher i have student data as below

bla bla...
bla blaa..
list of the student as below
student Name Student Course Student ID
mike computers 1
jhon electrical 2
alex civil 3

how can i get above information , i have use mulikv as below
index = myindex "student" | multikv forceheader=4 | table "student Name", "Student Course" "Student ID"
im unable to view the information.
How if i mention as only student
index = myindex "student" | multikv forceheader=4 | table student then i can view.
please let me know how can i view the dat along with field name with space.

[Richfez]

I think you are right in that multikv uses the same heuristics for splitting the header as for the content, and that your data is quite unusually formatted.

The best solution is if you can talk to the people who create this and have them output with quotes around the header stuff, or use a different field delimiter. This would solve problems you don't yet know you have, like what if someone has a space in their actual name, too? If the data looked like

Student Name|Student Course|Student ID
Mike|computers|1
John Boy|electrical|2
Alex|civil|3

Then you'd notice that even "John Boy" can be handled properly. Every tool worth its salt will be able to import that properly, so it shouldn't be an interoperability issue with anything else, and pretty much any tool can export in that format, too.

But, if you really can't get the data format changed, there are still ways to handle it.

I have your data above saved as a file in C:\Temp. I launched Splunk and click "Add Data" then "Monitor". Select on the left "Files & Directories", then select your file on the right. In my case that's "c:\temp\answers_455527.txt" then click next. The next page is to set the sourcetype and this is where the magic happens. We'll create a very custom sourcetype that you can re-use any time you have this sort of input. So, follow below and we'll get that done for you.

Pick a "Source Type" on the left near the top of "Structured" -> CSV. This is our starting point.

In the "Delimited settings" select a "Field delimiter" of space. In the file preample put in (bla bla|list of the|student Name) though you'll need to adjust the bla bla piece to match your data (I'm assuming the bla bla lines actually say something else). What is says is that if the header lines have the strings bla blah, list of the or student Name in them, ignore it. Make sure they'll never match a student name ( bla may match blake or blair, but I'm sure the real line won't have that problem).

Now, for the "Field Names" button you'll see it's auto. Instead, click "Custom" and paste/type into the "Comma separated field names" section Student Name,Student Course,Student ID and that should do it.

Now you can save the sourcetype as a new one to re-use. Click the "Save As" button and save it as perhaps "CSV for student files" or something like that. Put a description like "CSV using spaces and ignoring several student preamble lines".

Click next, sort out putting it in your student index, next, save (blah blah, all the rest of the wizard) then start searching and see what you've got!