Splunk Search

How to extract fields with values always on the same line and same row?

eichfuss
Path Finder

Hi Splunkers,

I tried a lot, but now I have no more idea. I would like to extract a log file like the following. It looks like a table, but any Number is a different information and has to be extracted as a single value. Each value is always on the same line and on the same row, but I was not able to extract this fields.

Hope anyone can help me and give me a hint.

Thanks
Regards, Sven

Log Example:
(The spaces in the rows are tabs in the original log file )

101 0 1 0 56 1
8 2 1 245 1 0
0 14 26 0 0 0
and so on

Tags (2)
0 Karma

rturk
Builder

Hi Sven,

Assuming you have already indexed the file, the following search (single line) will extract the values and assign them field names:

<base search> | rex "^(?<col_1>\d+)\s+(?<col_2>\d+)\s+(?<col_3>\d+)\s+(?<col_4>\d+)\s+(?<col_5>\d+)\s+(?<col_6>\d+)"

If you want Splunk to assign the events a specific sourcetype, and then automatically assign field names, then some further configuration of props.conf and transforms.conf is required.

I hope this helps 🙂

eichfuss
Path Finder

Sorry, forgot to answer you. It is one event / log with six columns and about 30 lines. Each number is a seperatet value and doesn´t depend on another value. For example one numer is the temperature, one is the time, one is a event id, and so on.

Cheers, Sven

0 Karma

kristian_kolb
Ultra Champion

So is that one multi-line event or three single-line events in your question? Could you please explain a bit more regarding what the data represents.

0 Karma

eichfuss
Path Finder

Thanks,

but I think you missunderstood me. Each number is a different value and has nothing to do with other values in the row or in the line.

So I had to extract every single number. I could now find the solution using the following:

(?:\s+\d+\t\d+\t\d+\t\d+\t\d+\t\d+){3}\s+\d+\t\d+\t(?P<xxxxx>\d+) 

Cheers, Sven

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...