Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Split multiline value field into separate lines
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a field which have multilines, how to split this field delimited by timestamp into separate lines
2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this (runanywhere search, everything except last line is just to generate sample data)
| gentimes start=-1 | eval Range="2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|" | table Range
| eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#\1"),"#LB#")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this (runanywhere search, everything except last line is just to generate sample data)
| gentimes start=-1 | eval Range="2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|" | table Range
| eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#\1"),"#LB#")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually i tried with | eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#$1"),"#LB#"), later got it. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried putting BREAK_ONLY_BEFORE_DATE = true in your props.conf file?
If this reply helps you, Karma would be appreciated.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Accelerate Splunk App Development with AI
Meet the .conf26 AI Agent Buildathon Winners
Trusted Autonomy in the SOC: A Maturity Journey
