如何破坏同一行中的两个 Splunk 日志?



我正在尝试破坏记录在同一行中的两个日志,因此在提取时下一个日志不会在结果中发布,而它显示在事件日志中。

02:09:50.296 64785434 [http-bio-8085-exec-156] INFO  c.i.p.w.r.s.AdjustmentServiceImpl - publicRequest: ,AccountID=123147309786219,ProductName="Product Online",ProductFlavor="ENHANCED",EventType=Usage,AdjustmentType=event,AdjustmentInputType=Amount,BillDate=2018-07-09,AdjustmentReason="Chargeback Event Adjustment",,SOAP Request:,AccountPOID="0.0.0.1 /account 324245253535",EventPOID="0.0.0.1 /event/activity/usage/payroll_per_employee 311258547968527414",AdjustmentAmount=1,AdjustmentPercentage=,Currency=GBP,Bill-ItemNo=23627727,1,AdjustmentDate=2018-07-14T04:00-07:00,IS_DEBIT_OR_CREDIT=CREDIT,TaxTreatment="Included Taxes in this adjustment",,SOAP Response:HttpStatus=200,,
02:09:50.826 64785964 [http-bio-8085-exec-156] INFO  c.i.p.w.r.s.AdjustmentServiceImpl - publicRequest: ,AccountID=123147309786219,ProductName="Product Online",ProductFlavor="ENHANCED",EventType=Usage,AdjustmentType=event,AdjustmentInputType=Amount,BillDate=2018-07-09,AdjustmentReason="Chargeback Event Adjustment",,SOAP Request:,AccountPOID="0.0.0.1 /account 324245253535",EventPOID="0.0.0.1 /event/activity/usage/payroll_per_employee 7378383763636373",AdjustmentAmount=1,AdjustmentPercentage=,Currency=GBP,Bill-ItemNo=23627727,1,AdjustmentDate=2018-07-14T04:00-07:00,IS_DEBIT_OR_CREDIT=CREDIT,TaxTreatment="Included Taxes in this adjustment",,SOAP Response:HttpStatus=200,,

如果您看到上面的日志,这是在同一行中设置的两个事件,但我无法在表中提取为两个事件。

请建议如何将其提取为两个事件。

如果可以识别事件之间的分隔符,请查看makemv命令。 它可以将事件拆分为多值字段。 通过管道将其传送到mvexpand以创建要处理的单独事件。

最新更新