Hey everyone. This is my first time working with data like this, so I'm a little bit lost. Here is a sample:
System Time: 14:16:39 UTC - WED AUG 21 2013
14:16:40-36
----- Inbound ----- ---- Outbound ----- -- Latency -- Max
Session Agents Active Rate ConEx Active Rate ConEx Avg Max Burst
s01-02.mydomain.net
I 0 0.0 0 0 0.0 3 0.056 0.086 1
s01-03.mydomain.net
I 847 7.4 0 784 12.6 16 0.045 0.343 34
s03-01a.mydomain.net
I 0 0.0 0 0 0.0 1 0.000 0.000 0
s03-02.mydomain.net
I 1 0.0 0 0 0.0 0 0.055 0.056 0
s03-02a.mydomain.net
I 0 0.0 0 0 0.0 1 0.055 0.055 0
s03-03.mydomain.net
I 529 3.9 0 524 6.8 4 0.037 0.181 30
s05-01.mydomain.net
I 603 3.7 0 605 7.2 4 0.031 0.087 32
s05-02.mydomain.net
I 0 0.0 0 0 0.0 3 0.054 0.055 0
What I am ultimately looking for is to break each value out into its own key-value pair, by host (so basically keep the time, and end up with a session agent field, an inbound-active field, an inbound-rate field, an inbound conex field, an outbound active field, an outbound rate field, an outbound conex field, a latency avg field, a latency max field, and a max burst field, for each host).
This can be done at search time (there won't be that many occurrences of this data). From there I'll put it in a summary index. I just can't quite get the built in commands to work correctly. Multikv doesn't seem to pull any of the values, and neither does extract. Any pointers would be very helpful, I think I may have jumped into the deep end with this particular input for my first time using non-csv data.
