Splunk Search

Can you help me with extract fields from the following WMIC log files?

rfellmann
New Member

I've got wmic logfiles which look like this:

Name Vendor Version

Java 8 Update 172 (64-bit) Oracle Corporation 8.0.1720.11
Java 8 Update 181 Oracle Corporation 8.0.1810.15

Java Auto Updater Oracle Corporation 2.8.172.11

alt text

  • Header is always the same
  • The logs can have more than one row (some have up to 5)
  • The actual data rows are always separated by two or more whitespaces

What's the proper way to extract these fields? I managed to extract the first row using the rex command — but then, all other rows are ignored. Using multiple piped rex would result in having multiple field names (Name1, Name2, Name3 etc) for each row.

| rex field=_raw "^(\w+\s+)+(?P\w+\s+\d+\s+\w+\s+\d+)\s+(?P\w+\s+\w+)\s+(?P[^ ]+)"

Thank you!

0 Karma
1 Solution

FrankVl
Ultra Champion

One option would be to take a look at the multikv command, which is specifically designed for processing such data.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv

View solution in original post

0 Karma

FrankVl
Ultra Champion

One option would be to take a look at the multikv command, which is specifically designed for processing such data.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv

0 Karma

rfellmann
New Member

Brilliant thank you - exactly what I was looking for.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...