Splunk Search

How to parse and extract unstructured .log file data in Splunk?

04/07/15 23:55:01
Device:    a      b      c      d      e       f      g      h      i      j      k
1ppd       0.00   0.00   0.00   0.00   0.00    0.00   0.00   0.00   0.00   0.00   0.00
2ppc       0.00   0.00   0.00   0.00   0.00    0.00   0.00   0.00   0.00   0.00   0.00
3ppb       0.00   5.00   0.00   1.00   0.00    24.00  41.00  0.00   2.00   1.00   0.80

It's a .log file, so it's not so structured hence uncommon to be parsed.
However, I'm desperately looking for ways to extract, say, column j and k from this log file and table it using Splunk.
I would appreciate any kind of input.

Thank you in advance,


multikv has been developed for this kind of table-ish source: http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/multikv

base search | multikv | ...


Well, I think semantically I'd argue that this data is indeed structured. That said, more detail is probably needed on the nature of what the row headings (1ppd, 1ppc, etc) and values (0.00, 5.00) represent before we can decide how best to parse this data.

0 Karma


Have you tried reading up on Field Extractions in Splunk?
Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX

You can also specify transforms for your data ( transforms.conf + props.conf)
Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextract...

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...