Splunk Search

Unable to break events using multikv?

sarvesh_11
Communicator

alt textHi Splunkers,
Please find attached image, this is the way i am getting my data.
My desired format is :

Hostname | Microsoft .NET Framework 4.5.1 | Microsoft POS for .NET 1.12 | JAVA 8 Update 60 | UniversalForwarder | - -------
hostA | 4.5.50938 | 1.12.1296 | 8.0.600 | 7.2.5 | - -------

My procedure is, to break the events with multikv and then use transpose.

But multikv is not functioning as desired.

TIA,

0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
| rex mode=sed "s/\s\s+/,/g"
| multikv forceheader=2

try this.

View solution in original post

vnravikumar
Champion

Hi

Attachment is missing.

0 Karma

sarvesh_11
Communicator

hi @vnravikumar ,

Updated

0 Karma

to4kawa
SplunkTrust
SplunkTrust
| rex mode=sed "s/\s\s+/,/g"
| multikv forceheader=2

try this.

View solution in original post

sarvesh_11
Communicator

Thanks @to4kawa

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!