Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Split multiline value field into separate lines
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a field which have multilines, how to split this field delimited by timestamp into separate lines
2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this (runanywhere search, everything except last line is just to generate sample data)
| gentimes start=-1 | eval Range="2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|" | table Range
| eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#\1"),"#LB#")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this (runanywhere search, everything except last line is just to generate sample data)
| gentimes start=-1 | eval Range="2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|" | table Range
| eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#\1"),"#LB#")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually i tried with | eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#$1"),"#LB#"), later got it. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried putting BREAK_ONLY_BEFORE_DATE = true in your props.conf file?
If this reply helps you, Karma would be appreciated.
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
