topic Re: split specific values from list in Splunk Search

split specific values from list

harishalipaka — Thu, 05 Mar 2020 11:49:40 GMT

Hi All,

I have data like below

Drive Free_Space

C:,D: 500 GB,450 GB
E:,D: 250 GB,150 GB
C:,E: 250 GB,1 TB
S:,D:,C:,G 120 GB,450 GB,250 GB,800 GB

I want output as

Please help me for this urgent
Thank you

Re: split specific values from list

ajayabburi508 — Wed, 30 Sep 2020 04:29:57 GMT

Hi Harish,

try this and if you like please accept and vote my answer

Re: split specific values from list

darrenfuller — Thu, 05 Mar 2020 15:25:30 GMT

Here is my attempt:

| makeresults 
| eval formatted_test_data="|<host1>C:,D: 500 GB,450 GB|<host2>E:,D: 250 GB,150 GB|<host3>C:,E: 250 GB,1 TB|<host4>S:,D:,C:,G: 120 GB,450 GB,250 GB,800 GB|"
| rex field=formatted_test_data "\|(?<test_data>[^\|]+)" max_match=0
| table _time test_data
| mvexpand test_data
| rex field=test_data "<(?<host>\w+)>"

| rex field=test_data "(?<drive>\w\:)" max_match=0
| rex field=test_data "(?<capacity>\d+\s[MGTP]B)" max_match=0
| eval drive_plus_capacity=mvzip(drive, capacity)
| fields - test_data capacity drive
| mvexpand drive_plus_capacity
| rex field=drive_plus_capacity "(?<drive>\w\:)\,(?<freespace>\d+\s[MGTP]B)"
| sort hostname drive
| streamstats count as drivenum by hostname reset_on_change=true
| chart list(drive_plus_capacity) over  hostname by drivenum
| rex field=1 "(?<drive1>\w\:)\,(?<freespace1>\d+\s[MGTP]B)"
| rex field=2 "(?<drive2>\w\:)\,(?<freespace2>\d+\s[MGTP]B)"
| rex field=3 "(?<drive3>\w\:)\,(?<freespace3>\d+\s[MGTP]B)"
| rex field=4 "(?<drive4>\w\:)\,(?<freespace4>\d+\s[MGTP]B)"
| fields - 1 2 3 4

./DF

Re: split specific values from list

manjunathmeti — Wed, 30 Sep 2020 04:30:05 GMT

Hi @harishalipaka,

Try this query:

| makemv delim="," Drive 
| makemv delim="," Free_Space 
| eval fields = mvzip(Drive,Free_Space) 
| rex field=fields "(?<Drive1>[C]+):,(?<Free_Space1>[\d]+\sGB)" 
| rex field=fields "(?<Drive2>[D]+):,(?<Free_Space2>[\d]+\sGB)" 
| table Drive1, Drive2, Free_Space1, Free_Space2

Sample query:

| makeresults
| eval _raw="Drive Free_Space
C:,D: 500 GB,450 GB
E:,D: 250 GB,150 GB
C:,E: 250 GB,1 TB
S:,D:,C:,G 120 GB,450 GB,250 GB,800 GB"
| multikv forceheader=1
| makemv delim="," Drive
| makemv delim="," Free_Space
| eval fields = mvzip(Drive,Free_Space)
| rex field=fields "(?[C]+):,(?[\d]+\sGB)"
| rex field=fields "(?[D]+):,(?[\d]+\sGB)"
| table Drive1, Drive2, Free_Space1, Free_Space2