Search Reference



NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.



Extracts field-values from table-formatted events.


multikv [conf=<stanza_name>] [<multikv-option>]*

Required arguments

Syntax: copyattrs=<bool> | fields <field-list> | filter <field-list> | forceheader=<int> | multitable=<bool> | noheader=<bool> | rmorig=<bool>
Description: Options for extracting fields from tabular events.

Optional arguments

Syntax: conf=<stanza_name>
Description: If you have a field extraction defined in multikv.conf, use this argument to reference the stanza in your search. For more information, refer to the configuration file reference for multikv.conf in the Admin Manual.

Multikv options

Syntax: copyattrs=<bool>
Description: Controls the copying of non-metadata attributes from the original event to extract events. Default is true.
Syntax: fields <field-list>
Description: Filters out from the extracted events fields that are not in the given field list.
Syntax: filter <field-list>
Description: If specified, a table row must contain one of the terms in the list before it is extracted into an event.
Syntax: forceheader=<int>
Description: Forces the use of the given line number (1 based) as the table's header. By default a header line is searched for.
Syntax: multitable=<bool>
Descriptions: Controls whether or not there can be multiple tables in a single _raw in the original events. (default = true)
Syntax: noheader=<bool>
Description: Allow tables with no header. If no header fields would be named column1, column2, ... (default = false)
Syntax: rmorig=<bool>
Description: Controls the removal of original events from the result set. (default=true)


Extracts fields from events with information in a tabular format (e.g. top, netstat, ps, ... etc). A new event will be created for each table row. Field names will be derived from the title row of the table.


Example 1: Extract the "COMMAND" field when it occurs in rows that contain "splunkd".

... | multikv fields COMMAND filter splunkd

Example 2: Extract the "pid" and "command" fields.

... | multikv fields pid command

See also

extract, kvform, rex, xmlkv


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the multikv command.

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 , 5.0 , 5.0.1 , 5.0.2 , 5.0.3 , 5.0.4 , 5.0.5 , 5.0.6 , 5.0.7 , 5.0.8 , 5.0.9 , 6.0 , 6.0.1 , 6.0.2 , 6.0.3 , 6.0.4 , 6.0.5 , 6.1 , 6.1.1 , 6.1.2 View the Article History for its revisions.


in examples, I'm always missing input and output, to understand how that works...
synopsis!=example !

May 1, 2013

You must be logged into in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!