Splunk Search

Split multiline value field into separate lines

srinathd
Contributor

I have a field which have multilines, how to split this field delimited by timestamp into separate lines

2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (runanywhere search, everything except last line is just to generate sample data)

| gentimes start=-1 | eval Range="2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|" | table Range 
| eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#\1"),"#LB#")

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this (runanywhere search, everything except last line is just to generate sample data)

| gentimes start=-1 | eval Range="2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|" | table Range 
| eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#\1"),"#LB#")
0 Karma

srinathd
Contributor

Actually i tried with | eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#$1"),"#LB#"), later got it. Thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried putting BREAK_ONLY_BEFORE_DATE = true in your props.conf file?

---
If this reply helps you, an upvote would be appreciated.
0 Karma