Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: extracting multiple values for a field from on...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
Regex is troubling me when i have to extract a field compared with previous line. My log is like
Thread Event1 blablabla [something]....completed.
idletime:45.56
Thread Event2 blablabla [something]....completed.no ststistics
Thread Event3 blablabla [something]....completed.no ststistics
Thread Event4 blablabla [something]....completed.no ststistics
Thread Event5 blablabla [something]....completed.
idletime:45.56
how to extract those idle time related with Event1? i have extracted the evantnames as field, but i am not getting any idea to continue the search with a regex.. please help..
Thank you for your time
Question edited
i am sorry that i am confusing you people.. i will try to be more precise about my question.
1.timestamp : [threadname] : threadid :logdetails
2.timestamp : [threadname] : threadid
...........log summary............
Thread Event1 blablabla [something]....completed.no ststistics
Thread Event2 blablabla [something]....completed.
idletime:33
busytime:88
Thread Event3 blablabla [something]....completed.no ststistics
Thread Event4 blablabla [something]....completed.
idletime:55
busytime:99
3.timestamp : [threadname] : threadid :logdetails
4.timestamp : [threadname] : threadid :logdetails
so issue here is, splunk reads only the first field that is it will read the italicized inputs, but i need it to read all the data in BOLD. i know that this issue is because splunk extract only the first value from a line and ignores the repeated ones and here all these information comes under one event and because of that splunk is ignoring the repeated values
so now please help me to solve this issue
thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@smolcj
Even if this is one single event and not being broken apart you should still be able to extract the idletime as a field.
Thread\sEvent\d.*[\r\n]\s+Idletime\:(?<##myIdleTime>\d+\.\d{2})
(Please remove the hashes from the line above, the formatting on answers doesn't like angle brackets.)
Splunk will look over multiple lines by default so you don't really have to set the (?m) flag.
Based on your comments you are actually looking to extract multiple fields from the multiline event you provided. With that in mind, I have taken the event log snippet and highlighted everything that based on your original question and your comments are what you wish to extract as fields:
Thread Event1 blablabla [something]....completed.
idletime:45.56
Thread Event2 blablabla [something]....completed.no ststistics
Thread Event3 blablabla [something]....completed.no ststistics
Thread Event4 blablabla [something]....completed.no ststistics
Thread Event5 blablabla [something]....completed.
idletime:45.56
The previous regex already extracts the idletime for you across multiple lines. Based on your regex in the comments;
(?i)Threads(?P<fieldname1>[^s]+)sblablablas[(?P<fieldname2>[^]]+)]...completed.nosstatistics
you would also like to extract another 2 fields. I am not sure if there were any typo's when you included that in your comments and the formatting rules made it a bit odd, but here is a corrected regex to match what you posted:
Thread\s(?<##fieldname1>[^\s]+).*?\[(?<##fieldname2>[^\]]+)\]\.{4}completed.no\sststistics
Lastly if you want to change that last regex to get the event number and "something" then you may want to change the above regex to:
Thread\s(?<##fieldname1>[^\s]+).*?\[(?<##fieldname2>[^\]]+)\]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well like I previously asked, how are you currently extracting it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The real issue is splunk reads only the first occurence of the event1 the second line is not reading as because it is in same event, how can i extract all the events?
please help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use the < character through explicitly typing the lt entity.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can make the regex multiline-capable by adding the flag (?m) at the beginning.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes it have a time stamp
log is like
timestamp severity processid Event1 bla blalog info
******** log statistics*******
Thread Event1 blablabla [something]....completed.
idletime:45.56
Thread Event2 blablabla [something]....completed.no ststistics
Thread Event3 blablabla [something]....completed.no ststistics
Thread Event4 blablabla [something]....completed.
idletime:45.56
timestamp severity processid Event1 bla blalog info
timestamp severity processid Event1 bla blalog info
timestamp severity processid Event1 bla blalog info
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@smolcj, So how does Splunk Break your event or is that one event defined by splunk. I dont see a time stamp?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
AYN, the log is defined so, these part of the log comes under some log summary.. so even if it come in next line, it is of same event details.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You might be looking for multi-value fields then: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureSplunktoparsemulti-valuefields
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's because you configured your extraction incorrectly. Where and how have you configured the field extraction?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All these logs come under one event, so even if i use (?m) only the first event name is extracting
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Observability Simplified: Combining User Experience, Application Performance & ...
Event Series May & June: From Network Visibility to Service Intelligence
Global Splunk User Group Events: May + June 2026
