Splunk Search

Unable to break events using multikv?

Path Finder

alt textHi Splunkers,
Please find attached image, this is the way i am getting my data.
My desired format is :

Hostname | Microsoft .NET Framework 4.5.1 | Microsoft POS for .NET 1.12 | JAVA 8 Update 60 | UniversalForwarder | - -------
hostA | 4.5.50938 | 1.12.1296 | 8.0.600 | 7.2.5 | - -------

My procedure is, to break the events with multikv and then use transpose.

But multikv is not functioning as desired.

TIA,

0 Karma

Champion

Hi

Attachment is missing.

0 Karma

Path Finder

hi @vnravikumar ,

Updated

0 Karma

Ultra Champion
| rex mode=sed "s/\s\s+/,/g"
| multikv forceheader=2

try this.

Path Finder

Thanks @to4kawa

0 Karma