Grep a part of the multiline event.

[sarvan7777]

I want to strip few rows from my log file and create a report in Splunk. Here is a sample even.

blah blah blah
blah blah blah
COUNT TOPIC COMPONENT

======= =========== ==========
586 ABC DEF
231 MNO XYZ
blah blah blah
blah blah blah

All I need is the fields count, topic and component along with the values in my report. Any input is highly appreciated

[woodcock · Accepted solution]

Like this:

Your Base Search Here
| rex "(?msi)^COUNT\s+TOPIC\s+COMPONENT[\r\n\s=]+(?<COUNT1>\S+)\s+(?<TOPIC1>\S+)\s+(?<COMPONENT1>\S+)[\r\n\s=]+(?<COUNT2>\S+)\s+(?<TOPIC2>\S+)\s+(?<COMPONENT2>\S+)"

You now have fields: COUNT1, TOPIC1, COMPONENT1, COUNT2, TOPIC2, and COMPONENT2.

[sarvan7777]

This is just what I want. Thanks for your response