splunksplunk-querysplunk-dashboard

Splunk result in Table format

Can you please help how to return below splunk result into Table format.

Employer details name Jon smith empid:4538938
Employer details name Mac Stone empid:4538939
Employer details name David smith empid:4534458

splunk Output in table format

Name          Empid
Jon smith     4538938
Mac Stone     4538939
David smith   4534458
Solution

  • If you don't already have anything parsing the information into fields, then you could apply a regex with rex to extract data into fields, and then plot as a table with the table command:

    | rex field=Message "Employer details name (?<name>.*) empid:(?<empid>\d+)"
| table name empid