topic Re: Extract selected fields from .txt in Splunk Dev

Extract selected fields from .txt

vickram — Wed, 30 Sep 2020 02:11:27 GMT

Hi All,
I Need to extract " CURDEPTH(553)" and "MAXDEPTH(15000)" as two seperate fields from the below .txt file (below is the sample stanza). Can you please help.

Thanks in advance.

1 : dis ql('PAPL.ESB.FDS.DELIVERYCONSTRUCT.QUEUE.ESBFDSIns1') curdepth,maxdepth
AMQ8409: Display Queue details.
QUEUE(PAPL.ESB.FDS.DELIVERYCONSTRUCT.QUEUE.ESBFDSIns1)
TYPE(QLOCAL) CURDEPTH(553)
MAXDEPTH(15000)

One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.
5724-H72 (C) Copyright IBM Corp. 1994, 2015.
Starting MQSC for queue manager PAPL_ESB_FDS_PRD_QM_223.

Re: Extract selected fields from .txt

diogofgm — Mon, 16 Sep 2019 14:13:05 GMT

In search you can use:

| rex "CURDEPTH\((?<cur_depth>[^\)]+)\)"
| rex "MAXDEPTH\((?<max_depth>[^\)]+)\)"

in props you can use the same regex in a EXTRACT-field = ...

Re: Extract selected fields from .txt

vik_splunk — Mon, 16 Sep 2019 14:26:29 GMT

HI @vickram , The below should work for you.

<base search>|rex "(?i)MAXDEPTH\((?P<Maxdepth>[^\)]+)"|rex "(?i)CURDEPTH\((?P<Curdepth>[^\)]+)"|stats count by Maxdepth,Curdepth

Re: Extract selected fields from .txt

vickram — Mon, 16 Sep 2019 14:47:46 GMT

Works perfectly 😉 thanks much

Re: Extract selected fields from .txt

vickram — Mon, 16 Sep 2019 14:48:05 GMT

Thanks for the help vik

Re: Extract selected fields from .txt

vickram — Wed, 30 Sep 2020 02:12:28 GMT

Thanks for the help. I have made the above query. I need to calculate the percentage of the "Maxdepth" field and compare with the "Curdepth" field and find the event When the "Curdepth" reaches 75% of the "Maxdepth".
Can you please help on this.

Re: Extract selected fields from .txt

vickram — Wed, 30 Sep 2020 02:12:31 GMT

Re: Extract selected fields from .txt

vickram — Wed, 30 Sep 2020 02:12:34 GMT

Re: Extract selected fields from .txt

vik_splunk — Tue, 17 Sep 2019 05:46:50 GMT

Add the below after the current query @vickram

|eval Percentage=(Curdepth/Maxdepth)*100|where Percentage>=75