Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Extract field multiline event without patterns

$
0
0
Hi, I'm trying to extract some lines from a multiline event, for example: 2016-05-17T19:40:37,022 INFO [00000033] :sassrv - 16 PROC SQL; 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 17 CREATE TABLE WORK.QUERY_FOR_TDWH051_QUOTES_TA AS 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 18 SELECT t1.DT_FECHAPRO, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 19 t1.I1, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 20 t1.'I1 SENTIT INFORMACIO'n, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 21 t1.I2, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 22 t1.'I2 NATURALESA OPERACIONS'n, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 23 t1.I3, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 24 t1.'I3 TIPUS COMPENSACIO'n, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 25 t1.ID_MENSAG, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 26 t1.MISSATGE, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 27 t1.'Codi proces'n, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 28 t1.PROCES, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 29 t1.Operacions, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 30 t1.IMPORT, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 31 t1.QUOTA1, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 32 /* quota% */ 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 33 (round(round((t1.QUOTA1 * 100), 0.01) / round(t1.IMPORT,0.01), 0.01)) FORMAT=8.2 LABEL="quota%" AS 'quota%'n, 2016-05-17T19:40:37,023 INFO [00000033] :sassrv - 34 t1.ID_TIPCUOT1, 2016-05-17T19:40:37,024 INFO [00000033] :sassrv - 35 t1.descripcio LABEL="DESCRIPCIO" 2016-05-17T19:40:37,024 INFO [00000033] :sassrv - 36 FROM WORK.QUERY_FOR_TDWH051_QUOTES_TA_0001 t1 2016-05-17T19:40:37,024 INFO [00000033] :sassrv - 37 WHERE t1.ID_MENSAG NOT = '1144'; 2016-05-17T19:40:37,024 TRACE [00000004] :sassrv - Libref=WORK Engine=V9 Member=QUERY_FOR_TDWH051_QUOTES_TA_0001 MemberType=DATA Openmode=INPUT Path=/SAS/tmp/SAS_work23F0005F0068_sasprod2/SAS_work8755005F0068_sasprod2 And I want to extract in a single field the following information: PROC SQL; CREATE TABLE WORK.QUERY_FOR_TDWH051_QUOTES_TA AS SELECT t1.DT_FECHAPRO, t1.I1, t1.'I1 SENTIT INFORMACIO'n, t1.I2, t1.'I2 NATURALESA OPERACIONS'n, t1.I3, t1.'I3 TIPUS COMPENSACIO'n, t1.ID_MENSAG, t1.MISSATGE, t1.'Codi proces'n, t1.PROCES, t1.Operacions, t1.IMPORT, t1.QUOTA1, /* quota% */ (round(round((t1.QUOTA1 * 100), 0.01) / round(t1.IMPORT,0.01), 0.01)) FORMAT=8.2 LABEL="quota%" AS 'quota%'n, t1.ID_TIPCUOT1, t1.descripcio LABEL="DESCRIPCIO" FROM WORK.QUERY_FOR_TDWH051_QUOTES_TA_0001 t1 WHERE t1.ID_MENSAG NOT = '1144'; is it possible? Note that all the lines are only one event. Thanks in advance. Alex

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>