Splunk Search

How Can I Separate Events Using Search Query?

dantimola
Communicator

Hi All,

Good Day, I've indexed an event from scripted input but the events are not breaking every line, example logs are in below. How can I expand the event to every line using Splunk Search Query? Thanks.

Sample event:

   02/02/2018        user, hostname
   12:00:00.000      user1, hostname1
                     user2, hostname2

Expected Output

02/02/2018     user, hostname
12:00:00.000

02/02/2018     user1, hostname1
12:00:00.000

02/02/2018     user2, hostname2
12:00:00.000
Tags (1)
0 Karma

dantimola
Communicator

This is the closest one I've got, however, it didn't split the event just like the output I wanted but it let me create a new field I need using rex.

<my search here>
| rex mode=sed "s/([\r\n]+)/||/g" 
| makemv _raw delim="||" 
| mvexpand _raw 
| rex (?<user>\w+) 
| rex "||"(?<user>\w+)
| rex ", "(?<hostname>\w+)
0 Karma

mayurr98
Super Champion

try this :

<your_base_search>| eval data=mvzip(user,hostname)
| makemv delim=","
| mvexpand data

let me know if this helps!

0 Karma

dantimola
Communicator

Thank you for your answer, I got the idea but it didn't give me the output I wanted.

0 Karma

mayurr98
Super Champion

can you provide some sample events ?

0 Karma

mayurr98
Super Champion

Try this run anywhere search

| makeresults 
| eval _time="02/02/2018 12:00:00.000",USER="username admin sample admin1",HOSTNAME="PC-1 PC-2 SERVER_1 SERVER_1" 
| makemv USER 
| makemv HOSTNAME 
| eval data=mvzip(HOSTNAME,USER) 
| mvexpand data 
| table _time data 
| rex field=data "(?<hostname>[^\,]+)\,(?<user>.*)" 
| fields- data
0 Karma

dantimola
Communicator

Here's the sample event:

username, PC-1
admin, PC-2
sample, SERVER_1
admin1, SERVER_1

The output I want is this

timestamp  username, PC-1
another timestamp admin, PC-2
.......
0 Karma

niketn
Legend

@dantimola can you add some sample raw event? Is Time field available for each line you want to break on? Is the following setting enabled for your scripted input sourcetype?

SHOULD_LINEMERGE = false
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dantimola
Communicator

SHOULD_LINEMERGE on props.conf already enabled. Sample raw event is in the "Sample Event:" found in the question.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...