I am doing a monitor file input of a nessas scan data files.
Splunk reads the files in as one event per line.
The report on each system scaned is between the following to tags in the data file
there can be as many as 3 or 4 hundred lines between these tags
I have two questions
1) What is the best way to put the data into splunk so that all the "ReportHost" info is together for searching reporting on each system?
2) how do I get the multi event information already in the splunk index together into one event for each ReportHost so that I can use the existing data to develop reports?