Splunk Search

How to extract fields with values always on the same line and same row?

eichfuss
Path Finder

Hi Splunkers,

I tried a lot, but now I have no more idea. I would like to extract a log file like the following. It looks like a table, but any Number is a different information and has to be extracted as a single value. Each value is always on the same line and on the same row, but I was not able to extract this fields.

Hope anyone can help me and give me a hint.

Thanks
Regards, Sven

Log Example:
(The spaces in the rows are tabs in the original log file )

101 0 1 0 56 1
8 2 1 245 1 0
0 14 26 0 0 0
and so on

Tags (2)
0 Karma

rturk
Builder

Hi Sven,

Assuming you have already indexed the file, the following search (single line) will extract the values and assign them field names:

<base search> | rex "^(?<col_1>\d+)\s+(?<col_2>\d+)\s+(?<col_3>\d+)\s+(?<col_4>\d+)\s+(?<col_5>\d+)\s+(?<col_6>\d+)"

If you want Splunk to assign the events a specific sourcetype, and then automatically assign field names, then some further configuration of props.conf and transforms.conf is required.

I hope this helps 🙂

eichfuss
Path Finder

Sorry, forgot to answer you. It is one event / log with six columns and about 30 lines. Each number is a seperatet value and doesn´t depend on another value. For example one numer is the temperature, one is the time, one is a event id, and so on.

Cheers, Sven

0 Karma

kristian_kolb
Ultra Champion

So is that one multi-line event or three single-line events in your question? Could you please explain a bit more regarding what the data represents.

0 Karma

eichfuss
Path Finder

Thanks,

but I think you missunderstood me. Each number is a different value and has nothing to do with other values in the row or in the line.

So I had to extract every single number. I could now find the solution using the following:

(?:\s+\d+\t\d+\t\d+\t\d+\t\d+\t\d+){3}\s+\d+\t\d+\t(?P<xxxxx>\d+) 

Cheers, Sven

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...