Refine your search:

I have a reoccurring line in a multi-line event of the form:

someName someValue someUnits I'm trying to save each occurrence of this someName someValue someUnits set, but only the last one is saved. I am extracting these with: [gztd] REGEX = ^.*\s+(\S+)\s+(\S+)\s+(\S+) FORMAT = td_name::$1 td_val::$2 td_units::$3 MV_ADD = true So, for example if I have: eff 80 % rate 47 GB I only get "rate" for td_name and "47" for td_val and never see the "eff" value. What I want to be able to create is a table for each occurrance. Thx.

asked 29 Nov '11, 16:33

cwi's gravatar image

accept rate: 0%

closed 30 Nov '11, 00:07

Ayn's gravatar image

Ayn ♦

The question has been closed for the following reason "Duplicate Content" by Ayn 30 Nov '11, 00:07

Follow this question

Log In to enable email subscriptions



Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported



Asked: 29 Nov '11, 16:33

Seen: 494 times

Last updated: 30 Nov '11, 00:07

Copyright © 2005-2014 Splunk Inc. All rights reserved.