Splunk Search

How to extract the count from below tabular form of logs

muguniya
Explorer
--------------------------------------------------------------
|          R u n    C o n t r o l     D i s p l a y          |
--------------------------------------------------------------
1.   ---------------------------------------------------------------
2.   |         X X X X X X X X   M U L T I - E N G I N E          |
3.   |            Run Control Display Begin                        |
4.   ---------------------------------------------------------------
5.   Job Instance ID: XXXXXXXX   Total Number of Engines Summarized: 22
6.   ---------------------------------------------------------------
7.   
8.   Description                                       Count
9.   Total NO OF Input                                14202
10.  status 16                                        0
11.  ---------------------------------------------------------------
12.  |         X X X X X X X X    M U L T I - E N G I N E          |
13.  |            Run Control Display End                          |
14.  ---------------------------------------------------------------
--------------------------------------------------------------
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think the mulikv command will help. Assuming the text of your example is a single event, this should extract the fields you seek:

... | multikv fields Description Count | table Description Count

You may need to add some options to multikv to help Splunk find the table in your event.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

ppablo
Community Manager
Community Manager

Hi @muguniya

What exactly do you mean "How to extra the count..." in your title? Can you provide more details what you need help with?

0 Karma

muguniya
Explorer

Hi @ppablo_splunk

Thank you for quick response.

Am trying to extract the count values from line 9 thru 10. Example, in one of the dashboard I want to show "Total no of Inputs : 14202" and "Status 16 entry: 0".

Please let me know for more information.

Thanks
Mugunthan

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.