multikv - remove unwanted rows from results

[axsolis]

Hi, I am successfully using multikv to parse my tabular data. However, my data has row separators and other non-intesting data that I would like to omit from the results. Is there a way to do this?

For example, The original data looks like this:

**This is data for XXXXX**

Heading1 Heading2 Heading3

-------------------------------------------
fieldA1 fieldA2 fieldA3
fieldB1
fieldB2 fieldB3
fieldC1 fieldC2
fieldC3

**This is data for XXXXX**

Heading1 Heading2 Heading3

-------------------------------------------
fieldA1 fieldA2 fieldA3
fieldB1
fieldB2 fieldB3
fieldC1 fieldC2
fieldC3

I obviously want to omit the lines starting with "**" and "--" from the results. How can I do this?

Thanks!

[aelliott · Accepted solution]

You will need a similar solution to this one:
http://answers.splunk.com/answers/34324/how-can-i-not-index-commented-lines-from-my-files

[axsolis]

That worked. I just placed the regex command after the multikv and it omitted the lines I wanted from the search. Thanks!

|multikv|regex _raw="^[^(-|\*).*$].*$"

Above I remove lines starting with "-" and "*".

[aelliott]

with slightly different regex