Splunk Dev

I want to know how can i get the data of a record in a tabular form output in SPlunk

c_scherr
Engager

Hello guys, I am trying to find a way to get the data in a record in the following manner to get i a table output in splunk . The data in the record is as follows

os_repo_status: last-update-result: [2018-01-25 18:53:14] {success} System update completed successfully
: remote-trigger: 1_per_hour UCMPROXY/tomorrowland-patching/os-update-trigger/FQHOST
: reboot-eligible: true
: next-update: NO_SCHEDULE
: update-eligible: true
: updates-available: false
I want to get the Fields "upadtes-available" field under the "os_repo_status" in the above list in a table output

my basic search is " | inputlookup mdbstaticlooup Where ....... | table os-repo-satus| "

i am not able to see anything in the os-repo-field in the table section.
Can any one Please help me in getting this solved .

Tags (1)
0 Karma

somesoni2
Revered Legend

So the above data is one single or multiple rows of your search | inputlookup mdbstaticlooup Where ....... | table os-repo-satus?

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...