show multlines event in column

[ch_goh]

Hi,
I have these multlines row event from different hosts and I would like show the multilines events by host. Example,HOST1 has these multilines event:

KEY             VALUE

CPUTYPE   AMD CPU X7560 @ 2.27GHz

CPUCACHE 24576 KB

CPUCOUNT 64

and HOST2 has these multilines event:

KEY             VALUE

CPUTYPE   Intel CPU E7330 @ 2.40GHz

CPUCACHE 3072 KB

CPUCOUNT 16

Now, I would like the search results to display them as:

KEY             HOST1                                        HOST2

CPUTYPE    AMD CPU X7560 @ 2.27GHz     Intel CPU E7330 @ 2.40GHz

CPUCACHE  24576 KB                                 3072 KB

CPUCOUNT  64                                            16

Please help.

Thanks,
C.H.

[yannK]

1- first extract the fields from each events.
by example with the rex command, or any automatic field extraction.
see http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsatsearchtime.

example with rex:

mysearch | rex "CPUCOUNT (?\d+)" 

2- then create a stats that will display then per host

... | stats value(cpucount) by host

3- rotate the table if you want each event as a column

... | transpose