Splunk Search

show multlines event in column

ch_goh
Explorer

Hi,
I have these multlines row event from different hosts and I would like show the multilines events by host. Example,HOST1 has these multilines event:

KEY             VALUE

CPUTYPE   AMD CPU X7560 @ 2.27GHz

CPUCACHE 24576 KB

CPUCOUNT 64

and HOST2 has these multilines event:

KEY             VALUE

CPUTYPE   Intel CPU E7330 @ 2.40GHz

CPUCACHE 3072 KB

CPUCOUNT 16

Now, I would like the search results to display them as:

KEY             HOST1                                        HOST2

CPUTYPE    AMD CPU X7560 @ 2.27GHz     Intel CPU E7330 @ 2.40GHz

CPUCACHE  24576 KB                                 3072 KB

CPUCOUNT  64                                            16

Please help.

Thanks,
C.H.

Tags (2)

yannK
Splunk Employee
Splunk Employee

1- first extract the fields from each events.
by example with the rex command, or any automatic field extraction.
see http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsatsearchtime.

example with rex:


mysearch | rex "CPUCOUNT (?\d+)"

2- then create a stats that will display then per host


... | stats value(cpucount) by host

3- rotate the table if you want each event as a column


... | transpose

Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...