如何在同一行中断开两个Splunk日志?

时间:2018-05-15 09:31:40

标签: splunk splunk-query

我正在尝试打破两个记录在同一行的日志,因为在提取时,下一个日志未在结果中发布,而它在事件日志中显示。

02:09:50.296 64785434 [http-bio-8085-exec-156] INFO  c.i.p.w.r.s.AdjustmentServiceImpl - publicRequest: ,AccountID=123147309786219,ProductName="Product Online",ProductFlavor="ENHANCED",EventType=Usage,AdjustmentType=event,AdjustmentInputType=Amount,BillDate=2018-07-09,AdjustmentReason="Chargeback Event Adjustment",,SOAP Request:,AccountPOID="0.0.0.1 /account 324245253535",EventPOID="0.0.0.1 /event/activity/usage/payroll_per_employee 311258547968527414",AdjustmentAmount=1,AdjustmentPercentage=,Currency=GBP,Bill-ItemNo=23627727,1,AdjustmentDate=2018-07-14T04:00-07:00,IS_DEBIT_OR_CREDIT=CREDIT,TaxTreatment="Included Taxes in this adjustment",,SOAP Response:HttpStatus=200,,
02:09:50.826 64785964 [http-bio-8085-exec-156] INFO  c.i.p.w.r.s.AdjustmentServiceImpl - publicRequest: ,AccountID=123147309786219,ProductName="Product Online",ProductFlavor="ENHANCED",EventType=Usage,AdjustmentType=event,AdjustmentInputType=Amount,BillDate=2018-07-09,AdjustmentReason="Chargeback Event Adjustment",,SOAP Request:,AccountPOID="0.0.0.1 /account 324245253535",EventPOID="0.0.0.1 /event/activity/usage/payroll_per_employee 7378383763636373",AdjustmentAmount=1,AdjustmentPercentage=,Currency=GBP,Bill-ItemNo=23627727,1,AdjustmentDate=2018-07-14T04:00-07:00,IS_DEBIT_OR_CREDIT=CREDIT,TaxTreatment="Included Taxes in this adjustment",,SOAP Response:HttpStatus=200,,

如果您看到上面的日志,这两个事件将在同一行中设置,但我无法在表中提取为两个事件。

请建议我如何将其作为两个事件提取。

1 个答案:

答案 0 :(得分:0)

如果您可以识别事件之间的分隔符,请查看makemv命令。它可以将事件拆分为多值字段。将其传递给mvexpand以创建要处理的单独事件。

相关问题