topic Re: Parsing Text in Getting Data In

Parsing Text

kenosborn — Fri, 04 May 2012 22:08:57 GMT

I have the following percent values in indexed logfiles:

Loss=0.00%/0.00% (R/T)

How can I construct a search query that will only look at the percent values before the '/' (aka 'R' or 'Receive)?

Conversely how can I construct a search query that will only look at the percent values after the '/' (aka 'T' or 'Transmit')?

Ultimately I want to create min/max charts for these values...

Thank you!

-Ken

Re: Parsing Text

kristian_kolb — Fri, 04 May 2012 22:41:47 GMT

That should be fairly simple

sourcetype=your_sourcetype | rex field=Loss "(?<ReceiveLoss>[^%]+)%/(?<TransmitLoss>[^%]+)%"

This would give you two new fields to make charts from.

This type of field extraction has to be specified as part of the search query, but you could make the extraction more 'permanent' by instead adding the extraction to the props.conf stanza for your sourcetype;

[your_sourcetype]
EXTRACT-blah Loss=(?<RecieveLoss>[^%]+)%/(?<TransmitLoss>[^%]+)

Either way, once you have the fields extracted, you could create charts with timechart or chart;

your_search |timechart span=5m max(ReceiveLoss) AS MaxRLoss min(ReceiveLoss) AS MinRLoss max(TransmitLoss) AS MaxTLoss min(TransmitLoss) AS MinTLoss

Then you can save it to a dashboard as a line chart or whatever you like.

Hope this helps,

Kristian

Re: Parsing Text

kristian_kolb — Fri, 04 May 2012 22:48:41 GMT

updated and fixed an error. /k

Re: Parsing Text

kristian_kolb — Fri, 04 May 2012 23:36:17 GMT

more updates. /k