--------------------------------------------------------------
| R u n C o n t r o l D i s p l a y |
--------------------------------------------------------------
1. ---------------------------------------------------------------
2. | X X X X X X X X M U L T I - E N G I N E |
3. | Run Control Display Begin |
4. ---------------------------------------------------------------
5. Job Instance ID: XXXXXXXX Total Number of Engines Summarized: 22
6. ---------------------------------------------------------------
7.
8. Description Count
9. Total NO OF Input 14202
10. status 16 0
11. ---------------------------------------------------------------
12. | X X X X X X X X M U L T I - E N G I N E |
13. | Run Control Display End |
14. ---------------------------------------------------------------
--------------------------------------------------------------
I think the mulikv
command will help. Assuming the text of your example is a single event, this should extract the fields you seek:
... | multikv fields Description Count | table Description Count
You may need to add some options to multikv
to help Splunk find the table in your event.
Hi @muguniya
What exactly do you mean "How to extra the count..." in your title? Can you provide more details what you need help with?
Hi @ppablo_splunk
Thank you for quick response.
Am trying to extract the count values from line 9 thru 10. Example, in one of the dashboard I want to show "Total no of Inputs : 14202" and "Status 16 entry: 0".
Please let me know for more information.
Thanks
Mugunthan