I have multivalued lines in my log file like below
abc\xFD123\xFDABC
aus\xFDIND\xFDUK
12\xFD34\xFD56
I have to show the report in table format like below
abc aus 12
123 IND 34
ABC UK 56
how to achieve this using a query. Please let me know
Thanks,
Srinath
Hi,
here is a run everywere example of how you can solve this problem. Maybe you have to adjust a little bit by using a table command at the end:
| stats count | fields - count | eval mv_field="abcxFD123xFDABC ausxFDINDxFDUK 12xFD34xFD56" | eval mv_field=replace('mv_field',"xFD",";") | rex field=mv_field "(?<ex_1>[^\;]+)\;(?<ex_2>[^\;]+)\;(?<ex_3>[^\;]+)\;(?<ex_4>[^\;]+)\;(?<ex_5>[^\;]+)\;(?<ex_6>[^\;]+)\;(?<ex_7>.*)$"
Greetings
Tom
Hi,
here is a run everywere example of how you can solve this problem. Maybe you have to adjust a little bit by using a table command at the end:
| stats count | fields - count | eval mv_field="abcxFD123xFDABC ausxFDINDxFDUK 12xFD34xFD56" | eval mv_field=replace('mv_field',"xFD",";") | rex field=mv_field "(?<ex_1>[^\;]+)\;(?<ex_2>[^\;]+)\;(?<ex_3>[^\;]+)\;(?<ex_4>[^\;]+)\;(?<ex_5>[^\;]+)\;(?<ex_6>[^\;]+)\;(?<ex_7>.*)$"
Greetings
Tom
Thanks for your answer. The entry in the log will be in this format
abc\xFD123\xFDABC aus\xFDIND\xFDUK 12\xFD34\xFD56
but i need to show in the table like below
abc aus 12
123 IND 34
ABC UK 56
Thanks,
Srinath
Is this: "abcxFD123xFDABC ausxFDINDxFDUK 12xFD34xFD56" all in one line, or in 3 seperate lines? sometimes a screenshot from the data as you can see it in splunk is the best for us to help.
I don't know, this looks pretty messy and complicated, but maybe it helps:
| stats count | fields - count | eval mv_field="abcxFD123xFDABC ausxFDINDxFDUK 12xFD34xFD56" | eval mv_field=replace('mv_field',"xFD",";") | rex field=mv_field "(?<a_1>[^\;]+)\;(?<a_2>[^\;]+)\;(?<a_3>[^ ]+) (?<b_1>[^\;]+)\;(?<b_2>[^\;]+)\;(?<b_3>[^ ]+) (?<c_1>[^\;]+)\;(?<c_2>[^\;]+)\;(?<c_3>.*)$" | eval row1='a_1'." ".'b_1'." ".'c_1' | eval row2='a_2'." ".'b_2'." ".'c_2' | eval row3='a_3'." ".'b_3'." ".'c_3' | table row* | transpose | rex field="row 1" "(?<value1>[^ ]*) (?<value2>[^ ]*) (?<value3>.*)$" | table value*