Search Reference

 


multikv

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

multikv

Synopsis

Extracts field-values from table-formatted events.

Syntax

multikv [conf=<stanza_name>] [<multikv-option>]*

Optional arguments

conf
Syntax: conf=<stanza_name>
Description: If you have a field extraction defined in multikv.conf, use this argument to reference the stanza in your search. For more information, refer to the configuration file reference for multikv.conf in the Admin Manual.
<multikv-option>
Syntax: copyattrs=<bool> | fields <field-list> | filter <field-list> | forceheader=<int> | last_line=<int> | max_header_line=<int> | max_header_lookahead=<int> | multitable=<bool> | noheader=<bool> | passthru=<bool> | rmorig=<bool> | start_line=<int>
Description: Options for extracting fields from tabular events.

Multikv options

copyattrs
Syntax: copyattrs=<bool>
Description: When true, multikv copies all fields from the original event to the events generated from that event. When false, no fields are copied from the original event. Note, this means that the events will have no _time field and the UI will not know how to display them. Default is true.
fields
Syntax: fields <field-list>
Description: Limit the fields set by the multikv extraction to this list. Any fields in the table which are not on this list will be ignored.
filter
Syntax: filter <term-list>
Description: If specified, multikv will skip over table rows that do not contain at least one of the strings in the filter list. Quoted expressions are permitted, such as "multiple words" or "trailing_space "
forceheader
Syntax: forceheader=<int>
Description: Forces the use of the given line number (1 based) as the table's header. Empty lines are not included in the count. By default multikv attempts to determine the header line automatically.
last_line
Syntax: last_line=<int>
Description: If set, prevents multikv from considering lines in input events past this line count. Use when you have non-tabular data after your tables in your events. Requires start_line, and must be greater than start_line.
max_header_line=<int>
Syntax: max_header_line=<int>
Description: If set, limits the number of lines that multikv will scan to auto-identify a header when noheader=false and forceheader is not set. This number indicates the last line to consider as a header.
max_header_lookahead=<int>
Syntax: max_header_lookahead=<int>
Description: A performance-optimizing constraint. When auto-identifying headers, how many lines to scan past a given auto-identified header in an attempt to find a better (more header-like) line to auto-identify as a header. If automatic header extraction is not finding the desired headers in a torturous case, you might want to increase this. If multikv is taking a very long time, you might want to try setting this to 1. Defaults to 2.
multitable
Syntax: multitable=<bool>
Description: Controls whether or not there can be multiple tables in a single _raw in the original events. (default = true)
noheader
Syntax: noheader=<bool>
Description: Handle a table without header row identification. The size of the table will be inferred from the first row, and fields will be named Column_1, Column_2, ... noheader=true implies multitable=false (default = false)
passthru
Syntax: passthru=<bool>
Description: By default (when false), input events which are not recognized as multikv tables are dropped. When passthru=true, input events which are not recognized as multikv tables are retained in the output events. This is independent of rmorig which applies to input events that *are* recognized as multikv tables. Defaults to false.
rmorig
Syntax: rmorig=<bool>
Description: When true, the original events will not be included in the output results. When false, the original events are retained in the output results, with each original emitted after the batch of generated results from that original. (default=true)
start_line
Syntax: start_line=<int>
Description: If set, prevents multikv from considering lines in the input prior to start_line. Must be a positive number. Use when your tabular data is preceded by non-tabular data, or if you want to precisely extract a later table independently of an earlier table for data that has multiple tables.

Description

Extracts fields from events with information in a tabular format (e.g. top, netstat, ps, ... etc). A new event will be created for each table row. Field names will be derived from the title row of the table.

An example of the type of data multikv is designed to handle:

Name     Age   Occupation
Josh     42    SoftwareEngineer
Francine 35    CEO
Samantha 22    ProjectManager

The key properties here are:

  • Each line of text represents a conceptual record.
  • The columns are aligned.
  • The first line of text provides the names for the data in the colums

multikv can transform this table from one event into three events with the relevant fields. It works more easily with the fixed-alignment though can sometimes handle merely ordered fields.

The general strategy is to try to identify a header, offsets, and field counts, and then determine which components of subsequent lines should be included into those field names. Multiple tables in a single event can be handled (if multitable=true), but may require ensuring that the secondary tables have capitalized or ALLCAPS names in a header row.

Auto-detection of header rows will favor rows that are text, and are ALLCAPS or Capitalized.

Examples

Example 1: Extract the "COMMAND" field when it occurs in rows that contain "splunkd".

... | multikv fields COMMAND filter splunkd

Example 2: Extract the "pid" and "command" fields.

... | multikv fields pid command

See also

extract, kvform, rex, xmlkv

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the multikv command.

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 , 5.0 , 5.0.1 , 5.0.2 , 5.0.3 , 5.0.4 , 5.0.5 , 5.0.6 , 5.0.7 , 5.0.8 , 5.0.9 , 5.0.10 , 5.0.11 , 6.0 , 6.0.1 , 6.0.2 , 6.0.3 , 6.0.4 , 6.0.5 , 6.0.6 , 6.0.7 , 6.1 , 6.1.1 , 6.1.2 , 6.1.3 , 6.1.4 , 6.1.5 , 6.2.0 , 6.2.1 View the Article History for its revisions.


Comments

in examples, I'm always missing input and output, to understand how that works...
synopsis!=example !

Sbsbb
May 1, 2013

You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!