- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Multline searches.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd like to get a bunch of data from disk configuration but its all multi-line stuff.
Data Sample below but this really is about 5000 disk. Would like to do searches for
'capacity added up for all unbound' or 'capacity for all Fibre Channel'.
What is a good way to search for this when the data is laid out in sets? I've seen
the splunk documentation where is says splunk groups these together automatically but
not sure what it means by that & see no evidence that there is any relationship when
I do searches.
Bus 0 Enclosure 0 Disk 0
State: Unbound
Drive Type: Fibre Channel
Capacity: 375600
Bus 0 Enclosure 0 Disk 1
State: Enabled
Drive Type: Fibre Channel
Capacity: 375600
Bus 0 Enclosure 0 Disk 2
State: Enabled
Drive Type: SATA
Capacity: 20000000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
clintla,
It is imperative when working with multi-line events that Splunk be given the appropriate line break settings for your data set. Once events are broken up properly you would easily be able to extract k-v pairs and search on the data. Here are some configurations to get you started.
## props.conf
[<spec>]
## Line break on "Bus...Enclosure...Disk"
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)Bus\s+\d+\s+Enclosure\s+\d+\s+Disk\s+\d+
## I don't see date/time in your events so we set DATETIME_CONFIG = CURRENT
DATETIME_CONFIG = CURRENT
## This will extract k-v pairs
KV_MODE = None
REPORT-auto_kv_for_my_sourcetype = auto_kv_for_my_sourcetype
## transforms.conf
[auto_kv_for_my_sourcetype]
REGEX = ^([^:]+):([^\r\n]+)
FORMAT = $1::$2
MV_ADD = True
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nice. I'll give it a go.
Your right about the time-there is no time. (just a config file)
But say if we got the logs once a month could we track a disk over time?
say if it went from UNBOUND to ENABLED at some point? (a precursor in another
search for trending info)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are batch importing data w/o date/time information it becomes very difficult to track anything over time. I would recommend either collecting this data in nearer real-time or adding date/timestamps to your events.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
clintla,
It is imperative when working with multi-line events that Splunk be given the appropriate line break settings for your data set. Once events are broken up properly you would easily be able to extract k-v pairs and search on the data. Here are some configurations to get you started.
## props.conf
[<spec>]
## Line break on "Bus...Enclosure...Disk"
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)Bus\s+\d+\s+Enclosure\s+\d+\s+Disk\s+\d+
## I don't see date/time in your events so we set DATETIME_CONFIG = CURRENT
DATETIME_CONFIG = CURRENT
## This will extract k-v pairs
KV_MODE = None
REPORT-auto_kv_for_my_sourcetype = auto_kv_for_my_sourcetype
## transforms.conf
[auto_kv_for_my_sourcetype]
REGEX = ^([^:]+):([^\r\n]+)
FORMAT = $1::$2
MV_ADD = True
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
