Splunk Search

Grep a part of the multiline event.

sarvan7777
New Member

I want to strip few rows from my log file and create a report in Splunk. Here is a sample even.

blah blah blah
blah blah blah
COUNT TOPIC COMPONENT

======= =========== ==========
586 ABC DEF
231 MNO XYZ
blah blah blah
blah blah blah

All I need is the fields count, topic and component along with the values in my report. Any input is highly appreciated

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| rex "(?msi)^COUNT\s+TOPIC\s+COMPONENT[\r\n\s=]+(?<COUNT1>\S+)\s+(?<TOPIC1>\S+)\s+(?<COMPONENT1>\S+)[\r\n\s=]+(?<COUNT2>\S+)\s+(?<TOPIC2>\S+)\s+(?<COMPONENT2>\S+)"

You now have fields: COUNT1, TOPIC1, COMPONENT1, COUNT2, TOPIC2, and COMPONENT2.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| rex "(?msi)^COUNT\s+TOPIC\s+COMPONENT[\r\n\s=]+(?<COUNT1>\S+)\s+(?<TOPIC1>\S+)\s+(?<COMPONENT1>\S+)[\r\n\s=]+(?<COUNT2>\S+)\s+(?<TOPIC2>\S+)\s+(?<COMPONENT2>\S+)"

You now have fields: COUNT1, TOPIC1, COMPONENT1, COUNT2, TOPIC2, and COMPONENT2.

View solution in original post

0 Karma

sarvan7777
New Member

This is just what I want. Thanks for your response

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!