topic Re: How to split my sample events using regular expression in Splunk Search

How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 18:49:17 GMT

Hi,
i have a sample data file like this, all columns are tab separated

TYPE                            Category             Count           CPU Usage (%)
Data Node                       Hadoop                26               0.17
Flume                           Hadoop                9                0.2
ResourceManager                 Hadoop                2                0.06
Hadoop                          ZooKeeper             5                0.19
Foyer                           Hadoop                2                0.28
Splunk                          Hadoop                1                0.06
RabbitMQ                        Non-Hadoop            7                0.98
PostGreSQL                      Non-Hadoop            3                0.11
TC_Server                       Non-Hadoop            12               0.67
Edge                            Hadoop                2                0.19

i want to import this into Splunk and need to split this data.
Finally, i need all the values in table format.
Thank you

Re: How to split my sample events using regular expression

horsefez — Fri, 16 Jun 2017 19:22:13 GMT

Hi,

how about that

(?:^\s*?)(?<TYPE>[^\t]+)(?:[\t\s]+)(?<Category>[^\t]+)(?:[\t\s]+)(?<Count>[^\t]+)(?:[\t\s]+)(?<CPU_Usage>[^\t]+)(?:[\t\s]+)?

Re: How to split my sample events using regular expression

somesoni2 — Fri, 16 Jun 2017 19:30:19 GMT

Look at this post

https://answers.splunk.com/answers/1048/how-do-index-tab-delimited-files.html

Re: How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 20:15:48 GMT

base search   |  rex " .*?(?:^\s*?)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)? " | table Type,CPU_Usage

I am not getting any data.

Re: How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 20:18:31 GMT

Its not working. I changed the files, but no use.

Re: How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 20:25:16 GMT

Can you provide me the regular expression?

Re: How to split my sample events using regular expression

aaraneta_splunk — Fri, 16 Jun 2017 20:26:29 GMT

@prathapkcsc - Just so you know, there is special markup language on this site so certain symbols will transform your post. If you wrap a word in the asterisk symbol * or _, without wrapping it in a code sample, it will italicize the word. If you wish to show the * (i.e. you are displaying sample code or search), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that the * will display.

Re: How to split my sample events using regular expression

somesoni2 — Fri, 16 Jun 2017 20:32:36 GMT

How does your data looks in Splunk? Does all these lines comes as part of single event OR each line is separate event?

If it's all coming as single event, you run search like this (will treat the event as table, split into rows with first line as header)

your base search | multikv

If each line is coming as separate event, then you can do like this

your base search | rex "(?<TYPE>.+)\t(?<Category>.+)\t(?<Count>.+)\t(?<CPU_Usage_Perc>.+)"

Re: How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 20:38:27 GMT

No, Above data is a single event.

Re: How to split my sample events using regular expression

horsefez — Fri, 16 Jun 2017 20:39:10 GMT

this is the wrong usage of the rex-command

... | rex field=_raw "(?:^\s*?)(?<TYPE>[^\t]+)(?:[\t\s]+)(?<Category>[^\t]+)(?:[\t\s]+)(?<Count>[^\t]+)(?:[\t\s]+)(?<CPU_Usage>[^\t]+)(?:[\t\s]+)?" | ...

Re: How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 21:09:27 GMT

 rex field=_raw "(?:^\s*?)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)?" | table TYPE Category

i tried the above query.
The entire data coming only in single row ( in TYPE).

Re: How to split my sample events using regular expression

woodcock — Fri, 16 Jun 2017 21:47:31 GMT

You need multikv like this:

|makeresults
| eval _raw = "TYPE                            Category             Count           CPU Usage (%)
Data Node                       Hadoop                26               0.17
Flume                           Hadoop                9                0.2
ResourceManager                 Hadoop                2                0.06
Hadoop                          ZooKeeper             5                0.19
Foyer                           Hadoop                2                0.28
Splunk                          Hadoop                1                0.06
RabbitMQ                        Non-Hadoop            7                0.98
PostGreSQL                      Non-Hadoop            3                0.11
TC_Server                       Non-Hadoop            12               0.67
Edge                            Hadoop                2                0.19"
| multikv forceheader=1

Re: How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 22:03:55 GMT

I don't want to hard code the values. Dynamically it has to take the event.

Re: How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 22:16:35 GMT

Please can you provide me the solution?
I want to avoid that copying data, How do i make it dynamic

Re: How to split my sample events using regular expression

woodcock — Fri, 16 Jun 2017 23:30:52 GMT

Don't be silly; the hardcoding wasy to show you that multikv works. Just add this to the bottom of your existing search:

... | mulitkv forceheader=1 | table *

See?

Re: How to split my sample events using regular expression

prathapkcsc — Fri, 16 Jun 2017 23:46:03 GMT

I didn't understand.
Please explain me clearly.
Thank you