Getting Data In

how to find n th line data using rex

srinathd
Contributor

Hi,

how to find nth line data in an event. for example: I have to get 7th line data and needs to correlate with the corresponding values in 8th line. how to achieve this

abc
xyz
1
001

45654
abc def ghi jkl mno
pqr stu vwx yza bcd
345

001

Thanks,
Srinath

Tags (1)
0 Karma
1 Solution

srinathd
Contributor

Using the rex we can extract 7 th line data from the multiline event
example: |rex "([^\n\r]*\n){6}(?[^\n\r]*)\n"

View solution in original post

0 Karma

srinathd
Contributor

Using the rex we can extract 7 th line data from the multiline event
example: |rex "([^\n\r]*\n){6}(?[^\n\r]*)\n"

0 Karma

srinathd
Contributor

get nth line data

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...