Splunk Search

Unable to break events using multikv?

sarvesh_11
Communicator

alt textHi Splunkers,
Please find attached image, this is the way i am getting my data.
My desired format is :

Hostname | Microsoft .NET Framework 4.5.1 | Microsoft POS for .NET 1.12 | JAVA 8 Update 60 | UniversalForwarder | - -------
hostA | 4.5.50938 | 1.12.1296 | 8.0.600 | 7.2.5 | - -------

My procedure is, to break the events with multikv and then use transpose.

But multikv is not functioning as desired.

TIA,

0 Karma
1 Solution

to4kawa
Ultra Champion
| rex mode=sed "s/\s\s+/,/g"
| multikv forceheader=2

try this.

View solution in original post

vnravikumar
Champion

Hi

Attachment is missing.

0 Karma

sarvesh_11
Communicator

hi @vnravikumar ,

Updated

0 Karma

to4kawa
Ultra Champion
| rex mode=sed "s/\s\s+/,/g"
| multikv forceheader=2

try this.

sarvesh_11
Communicator

Thanks @to4kawa

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...