Splunk Search

How to split a field having multiple lines into individual lines and finally display in table format

Splunk_sid
Loves-to-Learn Everything

I have field in the event which has multi-line data (between double quotes) and I need to split them into individual lines and finally extract them into a table format for each of the header. Basically, the requirement is to report this data in table format to users.

output = "DbName|CurrentSizeGB|UsedSpaceGB|FreeSpaceGB|ExtractedDate
abc|60.738|39.844|20.894|Sep 5 2023 10:00AM
def|0.098|0.017|0.081|Sep 5 2023 10:00AM
pqr|15.859|0.534|15.325|Sep 5 2023 10:00AM
xyz|32.733|0.675|32.058|Sep 5 2023 10:00AM"

Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The command is called multikv.

| rename _raw as temp, output AS _raw
| rex mode=sed "s/\|/,/g"
| multikv
| rename temp as _raw
Tags (1)
0 Karma

Splunk_sid
Loves-to-Learn Everything

@yuanliu - Its not working for this requirement. I see its returning entire output field value multiple times (equal to number of lines in the field.)

0 Karma

yuanliu
SplunkTrust
SplunkTrust
Its not working for this requirement. I see its returning entire output field value multiple times (equal to number of lines in the field.)

Note "not working" is about the least informative phrase in the best of scenarios as it conveys virtually no information.  Yes, the original output field is expected to be attached to each row.  If you don't want to see that, filter it out.

 

| eval _raw = replace(output, "\|", ",")
| multikv
| fields - _* linecount output

 

The real question is: are fields DbName, CurrentSizeGB, etc., extracted? (Each row is its own event.  If you want multivalued fields in  instead, you can do some stats.)  Here is an emulation that you can play with and compare with real data:

 

| makeresults
| eval output = "DbName|CurrentSizeGB|UsedSpaceGB|FreeSpaceGB|ExtractedDate
abc|60.738|39.844|20.894|Sep 5 2023 10:00AM
def|0.098|0.017|0.081|Sep 5 2023 10:00AM
pqr|15.859|0.534|15.325|Sep 5 2023 10:00AM
xyz|32.733|0.675|32.058|Sep 5 2023 10:00AM"
``` data emulation above ```

 

The above emulated input combined with the search gives

CurrentSizeGBDbNameExtractedDateFreeSpaceGBUsedSpaceGB
60.738abcSep 5 2023 10:00AM20.89439.844
0.098defSep 5 2023 10:00AM0.0810.017
15.859pqrSep 5 2023 10:00AM15.3250.534
32.733xyzSep 5 2023 10:00AM32.0580.675

If these fields are not extracted as expected, you need to illustrate your original data more precisely so volunteers can help diagnose. (Anonymous as needed.)  In addition, illustration of actual output will also be helpful instead of a useless phrase like "not working".

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...