topic Fields extraction from multi lines event in Splunk Search

Fields extraction from multi lines event

ali_alnajjar_ve — Mon, 01 Jul 2019 19:33:28 GMT

Hello folks,
I've this event from custom data source:

01/07/2019 16:27:08
type=cpu_util
SNMP table: HOST-RESOURCES-MIB::hrProcessorTable
hrProcessorFrwID hrProcessorLoad
SNMPv2-SMI::zeroDotZero 20
SNMPv2-SMI::zeroDotZero 17
SNMPv2-SMI::zeroDotZero 19
SNMPv2-SMI::zeroDotZero 23
SNMPv2-SMI::zeroDotZero 10
SNMPv2-SMI::zeroDotZero 22
SNMPv2-SMI::zeroDotZero 8
SNMPv2-SMI::zeroDotZero 4
SNMPv2-SMI::zeroDotZero 7
SNMPv2-SMI::zeroDotZero 3
SNMPv2-SMI::zeroDotZero 4
SNMPv2-SMI::zeroDotZero 6
SNMPv2-SMI::zeroDotZero 33
SNMPv2-SMI::zeroDotZero 14
SNMPv2-SMI::zeroDotZero 13
SNMPv2-SMI::zeroDotZero 8

this is a one event that represents the utilization for the cpu cores. how to extract the numbers in each row ? I tried but it extract the first number only (20) . how to write regex to extract all numbers.

Re: Fields extraction from multi lines event

FrankVl — Tue, 02 Jul 2019 07:42:52 GMT

Use a REPORT extraction and add MV_ADD = true in your transforms.conf. For example:

props.conf

[mysourcetype]
REPORT-cpu_util = my_cpu_util

transforms.conf

[my_cpu_util]
REGEX = SNMPv2-SMI::zeroDotZero\s+(?<cpu_util>\d+)
MV_ADD = true

This should result in a multi valued field called cpu_util.