How to extract all fields like DISK?

[ranjithan]

----------------------- DISK INFORMATION ----------------------------

DISK="/dev/sda" NAME="sda" HCTL="0:0:0:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="0" CHANNEL="0" ID="0" LUN="0" BOOTDISK="TRUE"

DISK="/dev/sdb" NAME="sdb" HCTL="0:0:0:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="0" CHANNEL="0" ID="0" LUN="1" BOOTDISK="FALSE"

DISK="/dev/sdc" NAME="sdc" HCTL="0:0:1:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="0" CHANNEL="0" ID="1" LUN="0" BOOTDISK="TRUE"

DISK="/dev/sdd" NAME="sdd" HCTL="0:0:1:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="0" CHANNEL="0" ID="1" LUN="1" BOOTDISK="FALSE"

DISK="/dev/sde" NAME="sde" HCTL="7:0:0:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="7" CHANNEL="0" ID="0" LUN="0" BOOTDISK="TRUE"

DISK="/dev/sdf" NAME="sdf" HCTL="7:0:0:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="7" CHANNEL="0" ID="0" LUN="1" BOOTDISK="FALSE"

DISK="/dev/sdg" NAME="sdg" HCTL="7:0:1:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="7" CHANNEL="0" ID="1" LUN="0" BOOTDISK="TRUE"

DISK="/dev/sdh" NAME="sdh" HCTL="7:0:1:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="7" CHANNEL="0" ID="1" LUN="1" BOOTDISK="FALSE"

My multiline event log looks like this in Splunk.  Could someone please help me extract all the fields like DISK, NAME, HCTL TYPE, VENDOR, SIZE using  SPL...

[ITWhisperer]

First you need to split the event(s) into separate lines (I have added a row count so you can keep track of the original event if that's important to you). Then extract the name/value pairs. Then create fields based on the names, with their corresponding values. Finally, join the fields together based on which line they came from.

| makeresults count=2
| streamstats count as row 
| eval _raw="----------------------- DISK INFORMATION ----------------------------
DISK=\"/dev/sda\" NAME=\"sda\" HCTL=\"0:0:0:0\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"120G\" SCSIHOST=\"0\" CHANNEL=\"0\" ID=\"0\" LUN=\"0\" BOOTDISK=\"TRUE\"
DISK=\"/dev/sdb\" NAME=\"sdb\" HCTL=\"0:0:0:1\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"300G\" SCSIHOST=\"0\" CHANNEL=\"0\" ID=\"0\" LUN=\"1\" BOOTDISK=\"FALSE\"
DISK=\"/dev/sdc\" NAME=\"sdc\" HCTL=\"0:0:1:0\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"120G\" SCSIHOST=\"0\" CHANNEL=\"0\" ID=\"1\" LUN=\"0\" BOOTDISK=\"TRUE\"
DISK=\"/dev/sdd\" NAME=\"sdd\" HCTL=\"0:0:1:1\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"300G\" SCSIHOST=\"0\" CHANNEL=\"0\" ID=\"1\" LUN=\"1\" BOOTDISK=\"FALSE\"
DISK=\"/dev/sde\" NAME=\"sde\" HCTL=\"7:0:0:0\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"120G\" SCSIHOST=\"7\" CHANNEL=\"0\" ID=\"0\" LUN=\"0\" BOOTDISK=\"TRUE\"
DISK=\"/dev/sdf\" NAME=\"sdf\" HCTL=\"7:0:0:1\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"300G\" SCSIHOST=\"7\" CHANNEL=\"0\" ID=\"0\" LUN=\"1\" BOOTDISK=\"FALSE\"
DISK=\"/dev/sdg\" NAME=\"sdg\" HCTL=\"7:0:1:0\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"120G\" SCSIHOST=\"7\" CHANNEL=\"0\" ID=\"1\" LUN=\"0\" BOOTDISK=\"TRUE\"
DISK=\"/dev/sdh\" NAME=\"sdh\" HCTL=\"7:0:1:1\" TYPE=\"disk\" VENDOR=\"3PARdata\" SIZE=\"300G\" SCSIHOST=\"7\" CHANNEL=\"0\" ID=\"1\" LUN=\"1\" BOOTDISK=\"FALSE\""
| multikv forceheader=1
| fields _raw row
| rex max_match=0 "(?<namevalue>\S+=\"[^\"]+\")"
| streamstats count as _row
| mvexpand namevalue
| rex field=namevalue "(?<_name>\S+)=\"(?<_value>[^\"]+)\""
| fields - namevalue
| eval {_name}=_value
| stats values(*) as * by row _row

[gcusello]

Hi @ranjithan,

my previous answer isn't ok for your needs?

https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values/m-p/586203#M204196

the above regex extracts all the fields from your new logs.

Ciao.

Giuseppe

[ranjithan]

This works, thank you so much Giuseppe 

[gcusello]

Hi @ranjithan,

if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉