12/27/21
6:42:50.000 AM
PSComputerName Name Memory
-------------- ---- ------
Host1 dfdf_Svc.exe 16024
Host1 sssService.exe 13142056
Host1 abcservice.exe 31380
Host1 xyzservice.exe 114340
Host1 rrrrr.exe 29304
12/27/21
6:42:50.000 AM
PSComputerName Name Memory
-------------- ---- ------
Host2 dfdf_Svc.exe 16064
Host2 sssService.exe 13144028
Host2 abcservice.exe 114708
Host2 xyzservice.exe 32248
Host2 rrrrr.exe 33616
I have these splunk output event in splunk logs. 1 event is for one specific server only. Under one server we have 5 services running and associated memory information. These output is in table format. I like to create regular expression so that I can create table format output as below:
Servername Servicename Memory(in MB) (since above memory in bytes)
Why use a regular expression when Splunk has a command specifically for this data format? Check out the multikv command at https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Multikv