topic Re: MVINDEX not working well with SPACE separated values in Getting Data In

MVINDEX not working well with SPACE separated values

mrigs — Sat, 30 Sep 2017 23:41:03 GMT

Hello All,

For an event like this -

CPU    uPct    nPct  sPct  wPct    iPct
all       0.63       0.00       0.38       0.00      98.99
0         0.00       0.00       0.00       0.00     100.00
1         1.00       0.00       0.00       0.00      99.00
2         0.00       0.00       0.00       0.00     100.00
3         0.00       0.00       0.00       0.00     100.00

I want to extract the iPct value for the all row. For some reason my split and mvindex commands are not working properly. This is what I have tried -

*<base search>*
| rex field=_raw "all(?<cpuUsage>.*)\\n"
| eval cpuFields = split(cpuUsage, " ")
| eval cpuIdle = mvindex(cpuFields,4)
| table _time, cpuIdle

The separation works fine, but may be I am doing something wrong with the mvindex? Please advise!

Thank you
M

Re: MVINDEX not working well with SPACE separated values

Sukisen1981 — Sun, 01 Oct 2017 13:12:14 GMT

what does cpuidle return for you?
i think maybe, you need to use -
| eval cpuIdle = mvindex(cpuFields,5) to get ipct values?
Can you please post a screen shot of what your CURRENT query returns?

Re: MVINDEX not working well with SPACE separated values

DalJeanis — Sun, 01 Oct 2017 16:14:12 GMT

The problem might be that there are multiple spaces between the values.

Since you only want the last value on the line, this would be simpler.

 *<base search>*
 | rex field=_raw "all.*\s(?<cpuIdle>\S+)$"

...or if you wanted everything on the all line...

 | rex "^(?<CPU>all)\s+(?<uPct>\S+)\s+(?<nPct>\S+)\s+(?<sPct>\S+)\s+(?<wPct>\S+)\s+(?<iPct>\S+)$"

...or on all lines...

 | rex "^(?<CPU>\S+)\s+(?<uPct>\S+)\s+(?<nPct>\S+)\s+(?<sPct>\S+)\s+(?<wPct>\S+)\s+(?<iPct>\S+)$"

Re: MVINDEX not working well with SPACE separated values

mrigs — Thu, 05 Oct 2017 02:23:40 GMT

My cpuidle shows up blank.

_time                   cpuUsage                    cpuFields   cpuIdle
2017-10-04 22:00:17     2.02 0.00 1.01 0.00 96.97   2.02    
                                                    0.00
                                                    1.01
                                                    0.00
                                                    96.97

Re: MVINDEX not working well with SPACE separated values

mrigs — Thu, 05 Oct 2017 02:26:45 GMT

Thank you. A bit crude, but this worked for me -

| rex field=_raw "all(?:.*) (?<cpuIdle>([0-9]|\.)+)\\n"

It would still be interesting to find out why my SPLIT didn't work as expected!