How to extract fields with values always on the same line and same row?

[eichfuss]

Hi Splunkers,

I tried a lot, but now I have no more idea. I would like to extract a log file like the following. It looks like a table, but any Number is a different information and has to be extracted as a single value. Each value is always on the same line and on the same row, but I was not able to extract this fields.

Hope anyone can help me and give me a hint.

Thanks
Regards, Sven

Log Example:
(The spaces in the rows are tabs in the original log file )

101 0 1 0 56 1
8 2 1 245 1 0
0 14 26 0 0 0
and so on

[rturk]

Hi Sven,

Assuming you have already indexed the file, the following search (single line) will extract the values and assign them field names:

<base search> | rex "^(?<col_1>\d+)\s+(?<col_2>\d+)\s+(?<col_3>\d+)\s+(?<col_4>\d+)\s+(?<col_5>\d+)\s+(?<col_6>\d+)"

If you want Splunk to assign the events a specific sourcetype, and then automatically assign field names, then some further configuration of props.conf and transforms.conf is required.

I hope this helps 🙂

[eichfuss]

Sorry, forgot to answer you. It is one event / log with six columns and about 30 lines. Each number is a seperatet value and doesn´t depend on another value. For example one numer is the temperature, one is the time, one is a event id, and so on.

Cheers, Sven

[kristian_kolb]

So is that one multi-line event or three single-line events in your question? Could you please explain a bit more regarding what the data represents.

[eichfuss]

Thanks,

but I think you missunderstood me. Each number is a different value and has nothing to do with other values in the row or in the line.

So I had to extract every single number. I could now find the solution using the following:

(?:\s+\d+\t\d+\t\d+\t\d+\t\d+\t\d+){3}\s+\d+\t\d+\t(?P<xxxxx>\d+) 

Cheers, Sven