Splunk Search

Can you help me with extract fields from the following WMIC log files?

rfellmann
New Member

I've got wmic logfiles which look like this:

Name Vendor Version

Java 8 Update 172 (64-bit) Oracle Corporation 8.0.1720.11
Java 8 Update 181 Oracle Corporation 8.0.1810.15

Java Auto Updater Oracle Corporation 2.8.172.11

alt text

  • Header is always the same
  • The logs can have more than one row (some have up to 5)
  • The actual data rows are always separated by two or more whitespaces

What's the proper way to extract these fields? I managed to extract the first row using the rex command — but then, all other rows are ignored. Using multiple piped rex would result in having multiple field names (Name1, Name2, Name3 etc) for each row.

| rex field=_raw "^(\w+\s+)+(?P\w+\s+\d+\s+\w+\s+\d+)\s+(?P\w+\s+\w+)\s+(?P[^ ]+)"

Thank you!

0 Karma
1 Solution

FrankVl
Ultra Champion

One option would be to take a look at the multikv command, which is specifically designed for processing such data.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv

View solution in original post

0 Karma

FrankVl
Ultra Champion

One option would be to take a look at the multikv command, which is specifically designed for processing such data.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv

0 Karma

rfellmann
New Member

Brilliant thank you - exactly what I was looking for.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...