Splunk Search

multikv on raw data (row timestamp)

minkyuk
Explorer

Hello-
I'll jump into the main part.

Here is a snippet:
Tue 2015 15:00:23
ZGD-OCU-QQQ
POS-BKD-AKD
COK-ZPP-AKF

DISK-------USAGE-------HOST

My multikv extraction thinks "ZGD-OCU-QQQ" is my "fields".
It definitely is correctly extracting the information, but I'm trying to find a way to skip 3 lines-rows- after the timestamp to extract correct fields.

I would appreciate any help..!
J

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try ... | multikv start_line=4 .... Adjust the start_line value as necessary.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try ... | multikv start_line=4 .... Adjust the start_line value as necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

minkyuk
Explorer

I still need to read the first line to record the Timestamp, however.

Could I use any variation?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use rex to extract the timestamp before using multikv on the rest.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...