Hi,
I have these multlines row event from different hosts and I would like show the multilines events by host. Example,HOST1 has these multilines event:
KEY VALUE
CPUTYPE AMD CPU X7560 @ 2.27GHz
CPUCACHE 24576 KB
CPUCOUNT 64
and HOST2 has these multilines event:
KEY VALUE
CPUTYPE Intel CPU E7330 @ 2.40GHz
CPUCACHE 3072 KB
CPUCOUNT 16
Now, I would like the search results to display them as:
KEY HOST1 HOST2
CPUTYPE AMD CPU X7560 @ 2.27GHz Intel CPU E7330 @ 2.40GHz
CPUCACHE 24576 KB 3072 KB
CPUCOUNT 64 16
Please help.
Thanks,
C.H.
1- first extract the fields from each events.
by example with the rex command, or any automatic field extraction.
see http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsatsearchtime.
example with rex:
mysearch | rex "CPUCOUNT (?\d+)"
2- then create a stats that will display then per host
... | stats value(cpucount) by host
3- rotate the table if you want each event as a column
... | transpose