Split merged events

[zoebanning]

Hello Splunk Community, 

I have a merged event which shows if a service is running or down. Here is an example of the event in splunk:

******************************************************************************* All services are running

1092827|default|service1is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************

How can I split the merged events so I can extract the service name, status (running/down) & host?

16272373|default|service3 is running

Host |      | ServiceName is Status

[richgalloway]

Here's one way to do it.  

| makeresults | eval _raw="******************************************************************************* All services are running

1092827|default|service1 is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************"
```The above just defines test data```
```Copy the raw event because we can't split _raw.```
| eval data=_raw
```Divide the event into lines```
| eval data=split(data,"
")
```Create one event for each line```
| mvexpand data
```Put _raw back```.
| eval _raw=data
```Filter out "****" and blank lines```
| regex "^\d"
```Extract host, service, and status fields```
| rex "(?<Host>\d+)\|\w+\|(?<service>\S+) is (?<status>\S+)"
```Display the fields```
| table Host service status

[bowesmana]

You can run this example

| makeresults
| eval _raw="******************************************************************************* All services are running

1092827|default|service1 is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************"
| rex max_match=0 "(?<event>\d+\|default\|.*)"
| mvexpand event
| table event
| rex field=event "(?<host>\d+)\|default\|(?<service>\w+)\sis\s(?<status>.*)"
| table host service status

It shows you a way to extract the original event from the multiline merged data and then to expand those to individual events. The second rex then extracts those fields.