Splunk Search

How can I perform a field extraction and display it as a table that contains all the values from my search?

senthamilselvan
Engager

Hi Team,

Please find the below log sample. I want to extract from the line "program" till the end and display as a table which contains all the values as shown in the output..

REPLICATION LAG

Oracle GoldenGate Command Interpreter for DB2 Version 12.1.2.1.5 20635622 OGGCORE_12.1.2.1.0OGGBP_PLATFORMS_150320.0454
AIX 6, ppc, 64bit (optimized), DB2 10.5 on Apr 23 2015 00:58:12 Operating system character set identified as ISO-8859-1.

Copyright (C) 1995, 2015, Oracle and/or its affiliates. All rights reserved.

GGSCI (nc006qad02) 1> info all

Program     Status      Group       LagatChkpt  TimeSinceChkpt
MANAGER     RUNNING                                           
JAGENT      RUNNING                                           
REPLICAT    RUNNING     REPHG       00:00:00      00:00:05    
REPLICAT    RUNNING     REPRA       00:00:00      00:00:07    
REPLICAT    RUNNING     REPSD       00:00:00      00:00:00    
REPLICAT    STOPPED     RILAA       00:00:00      3489:18:54  
REPLICAT    STOPPED     RILQQ       00:00:00      3166:32:14  
REPLICAT    STOPPED     RILRA       00:00:00      3489:18:44  
REPLICAT    STOPPED     RILRH       00:00:00      3489:18:01  
REPLICAT    STOPPED     RILTT       00:00:00      3489:18:36  
REPLICAT    RUNNING     RPLXQ       00:00:00      00:00:04    
REPLICAT    ABENDED     RRAHG       2125:39:25    01:13:05    

output table will be: and the first line will be header of the table.

Program     Status      Group       LagatChkpt  TimeSinceChkpt
MANAGER     RUNNING                                           
JAGENT      RUNNING                                           
REPLICAT    RUNNING     REPHG       00:00:00      00:00:05    
REPLICAT    RUNNING     REPRA       00:00:00      00:00:07    
REPLICAT    RUNNING     REPSD       00:00:00      00:00:00    
REPLICAT    STOPPED     RILAA       00:00:00      3489:18:54  
REPLICAT    STOPPED     RILQQ       00:00:00      3166:32:14  
REPLICAT    STOPPED     RILRA       00:00:00      3489:18:44  
REPLICAT    STOPPED     RILRH       00:00:00      3489:18:01  
REPLICAT    STOPPED     RILTT       00:00:00      3489:18:36  
REPLICAT    RUNNING     RPLXQ       00:00:00      00:00:04    
REPLICAT    ABENDED     RRAHG       2125:39:25    01:13:05
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you can treat all of the lines as a single event then the multikv command should help.

---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

Does all those lines part of single event?

0 Karma

senthamilselvan
Engager

we can consider as single event or we can break into multiple as well. Because that is sample file am going to index

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...