Splunk Search

How to make a loop in one event?

sabinayang
Observer

My log is like this:

TimeEvent
3/23/22 11:00:00.000 AM

Application 'AAA' is running

Application 'BBB' is stopped

Database 'CCC' is running

Database 'DDD' is running

3/23/22 11:10:00.000 AM

Application 'AAA' is running

Application 'BBB' is running

Database 'CCC' is stopped

Database 'DDD' is running

 

I want to extract a table like

TimeServerHostStatus
3/23/22 11:00:00.000 AMApplicationAAArunning
3/23/22 11:00:00.000 AMApplicationBBBstopped
3/23/22 11:00:00.000 AMDatabaseCCCrunning
3/23/22 11:00:00.000 AMDatabaseDDDrunning
3/23/22 11:10:00.000 AMApplicationAAArunning
3/23/22 11:10:00.000 AMApplicationBBBrunning
3/23/22 11:10:00.000 AMDatabaseCCCstopped
3/23/22 11:10:00.000 AMDatabaseDDDrunning

 

How to do this? If anyone has idea?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is event a multivalue field - if so, use mvexpand to expand to multiple events, then you can extract server, host and status from the event field

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...