topic Re: How to split a single line event into multiple events at search time? in Getting Data In

How to split a single line event into multiple events at search time?

romaindelmotte — Thu, 26 Nov 2015 17:27:32 GMT

Hi,

I have those kind of events indexed:

11/26/15 15:05:11.000 retrievePending=0 mergePending=1823 sendPending=43 resendPending=2

The numbers above are the count of pending tasks in different queues of an application.
Unfortunately, I cannot change the way the logs are written down in the log files, and wished it was something like this:

11/26/15 15:05:11.000 queue=retrieve pending=0
11/26/15 15:05:11.000 queue=merge pending=1823
11/26/15 15:05:11.000 queue=send pending=43
11/26/15 15:05:11.000 queue=resend pending=2

So, is there a way - at search time - to split my data into multiple events so I can use a by clause like below?

index=main sourcetype=queues host=web01 | timechart avg(pending) by queue

I've been looking for some time now, even playing with multi-value commands like mvzip, mkexpand, etc., but can't crack this one.

Any help would be appreciated.

Thanks,

Romain

Re: How to split a single line event into multiple events at search time?

romaindelmotte — Thu, 26 Nov 2015 18:11:24 GMT

Just find a way myself, actually.

 index=main sourcetype=queues host=web01
| eval fields=mvappend("retrieve:".retrievePending,"merge:".mergePending,"send:".sendPending,"resend:".resendPending)
| mvexpand fields
| makemv delim=":" fields
| eval queue=mvindex(fields,0)
| eval count=mvindex(fields,1)
| eval ratio=round((count/500)*100, 2)
| timechart avg(ratio) by queue

Any way to make that a bit more efficient, though?

Re: How to split a single line event into multiple events at search time?

fpavlovi — Sun, 25 Feb 2018 06:37:19 GMT

It helped me as well, thank you for sharing!