Splunk Search

Extracting number of fields from a multi line event

hiwell
Explorer

Hello,

I am trying to extract fields from an event which looks like this (I have multiple events)

total time (ms): 5 
web server processing time (ms/%): 2 40 
transmission time (ms/%): 3 60 
bytes sent/received: 100 200 
start time (ms): 1234 
end time(ms): 2345

some lines have one field, and other have two fields making it impossible for me to extract these numbers. I would like splunk to create two separate fields for the lines which have two parameters but I have not been successful in doing so. Anyone have any idea(s) to get this to work? Or is this not possible. Thanks!

0 Karma

hiwell
Explorer

I ended up writing a script to pre-process the file to make the data Splunk-friendly.

0 Karma

katalinali
Path Finder

You may need to break every line as an event and define two regex like:

REGEX...:(\d+)\s+(\d+) FORMAT=field1::$1 field2::$2

REGEX=...:(\d+) FORMAT=field3::$1

hiwell
Explorer

😞 it definitely pulls out a few of the fields but its very redundant and the regexes triggers for all the events giving a lot of garbage fields. Thanks though! This could be useful for other cases

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...