I am trying to extract fields from an event which looks like this (I have multiple events)
some lines have one field, and other have two fields making it impossible for me to extract these numbers. I would like splunk to create two separate fields for the lines which have two parameters but I have not been successful in doing so. Anyone have any idea(s) to get this to work? Or is this not possible. Thanks!
asked 22 Jun '10, 23:06
You may need to break every line as an event and define two regex like:
REGEX...:(\d+)\s+(\d+) FORMAT=field1::$1 field2::$2
answered 23 Jun '10, 02:45