Splunk Search

show multlines event in column

ch_goh
Explorer

Hi,
I have these multlines row event from different hosts and I would like show the multilines events by host. Example,HOST1 has these multilines event:

KEY             VALUE

CPUTYPE   AMD CPU X7560 @ 2.27GHz

CPUCACHE 24576 KB

CPUCOUNT 64

and HOST2 has these multilines event:

KEY             VALUE

CPUTYPE   Intel CPU E7330 @ 2.40GHz

CPUCACHE 3072 KB

CPUCOUNT 16

Now, I would like the search results to display them as:

KEY             HOST1                                        HOST2

CPUTYPE    AMD CPU X7560 @ 2.27GHz     Intel CPU E7330 @ 2.40GHz

CPUCACHE  24576 KB                                 3072 KB

CPUCOUNT  64                                            16

Please help.

Thanks,
C.H.

Tags (2)

yannK
Splunk Employee
Splunk Employee

1- first extract the fields from each events.
by example with the rex command, or any automatic field extraction.
see http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsatsearchtime.

example with rex:


mysearch | rex "CPUCOUNT (?\d+)"

2- then create a stats that will display then per host


... | stats value(cpucount) by host

3- rotate the table if you want each event as a column


... | transpose

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...