...pply multikv on the results, I am only applying it to RealServer3, and not to the rest of the virtual servers.
I tried to do a search e.g.
sourcetype=virtuallogs "Name: RealServer3" | multikv...
...imechart over one of the values the multikv doesn't generate any field. Also playing with the field picker does not work. Any ideas how can I pick two fields here: "idx_size_kB" and "idx"??
i...
Hi, I am successfully using multikv to parse my tabular data. However, my data has row separators and other non-intesting data that I would like to omit from the results. Is there a way to do t...
Is it possible to create a field extraction on a field that only exists after piping through multikv?
In other words, can I persist this:
index="os" sourcetype="netstat" | multikv | rex f...
Hello-
I'll jump into the main part.
Here is a snippet:
Tue 2015 15:00:23
ZGD-OCU-QQQ
POS-BKD-AKD
COK-ZPP-AKF
DISK-------USAGE-------HOST
My multikv extraction thinks "ZGD-OCU-Q...
Hi Splunkers,
So I'm getting started with multikv extractions, and I've come across this issue. I'm attempting to generate a report (based on the output of Solarwinds) that will graph the a...
I have a chart command i've been gathering all the netstat values for a single hour
index=os host=ship* starttime=10/01/2014:19:00:00 endtime=10/01/2014:19:20:00 sourcetype=netstat | multikv f...
...ile with many lines.
I use the multikv command to split the each multi-line event into individual events. With data models that apparently is only possible when using root searches - I cannot use p...