04/07/15 23:55:01
Device: a b c d e f g h i j k
1ppd 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
2ppc 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
3ppb 0.00 5.00 0.00 1.00 0.00 24.00 41.00 0.00 2.00 1.00 0.80
It's a .log file, so it's not so structured hence uncommon to be parsed.
However, I'm desperately looking for ways to extract, say, column j and k from this log file and table it using Splunk.
I would appreciate any kind of input.
Thank you in advance,
Best,
Jack
multikv
has been developed for this kind of table-ish source: http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/multikv
base search | multikv | ...
Well, I think semantically I'd argue that this data is indeed structured. That said, more detail is probably needed on the nature of what the row headings (1ppd, 1ppc, etc) and values (0.00, 5.00) represent before we can decide how best to parse this data.
Have you tried reading up on Field Extractions in Splunk?
Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX
You can also specify transforms for your data ( transforms.conf + props.conf)
Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextract...