multikv on raw data (row timestamp)

[minkyuk]

Hello-
I'll jump into the main part.

Here is a snippet:
Tue 2015 15:00:23
ZGD-OCU-QQQ
POS-BKD-AKD
COK-ZPP-AKF

DISK-------USAGE-------HOST

My multikv extraction thinks "ZGD-OCU-QQQ" is my "fields".
It definitely is correctly extracting the information, but I'm trying to find a way to skip 3 lines-rows- after the timestamp to extract correct fields.

I would appreciate any help..!
J

[richgalloway · Accepted solution]

Try ... | multikv start_line=4 .... Adjust the start_line value as necessary.

[minkyuk]

I still need to read the first line to record the Timestamp, however.

Could I use any variation?

[richgalloway]

Use rex to extract the timestamp before using multikv on the rest.