Splunk Search

show multlines event in column

ch_goh
Explorer

Hi,
I have these multlines row event from different hosts and I would like show the multilines events by host. Example,HOST1 has these multilines event:

KEY             VALUE

CPUTYPE   AMD CPU X7560 @ 2.27GHz

CPUCACHE 24576 KB

CPUCOUNT 64

and HOST2 has these multilines event:

KEY             VALUE

CPUTYPE   Intel CPU E7330 @ 2.40GHz

CPUCACHE 3072 KB

CPUCOUNT 16

Now, I would like the search results to display them as:

KEY             HOST1                                        HOST2

CPUTYPE    AMD CPU X7560 @ 2.27GHz     Intel CPU E7330 @ 2.40GHz

CPUCACHE  24576 KB                                 3072 KB

CPUCOUNT  64                                            16

Please help.

Thanks,
C.H.

Tags (2)

yannK
Splunk Employee
Splunk Employee

1- first extract the fields from each events.
by example with the rex command, or any automatic field extraction.
see http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsatsearchtime.

example with rex:


mysearch | rex "CPUCOUNT (?\d+)"

2- then create a stats that will display then per host


... | stats value(cpucount) by host

3- rotate the table if you want each event as a column


... | transpose

Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...