topic Re: regex formation in Splunk Search

regex formation

harsh1734 — Fri, 02 Aug 2013 05:15:55 GMT

hi,
in my log files there is a field name cpu time with different time values like 57.682 sec,0.572 sec and among the highest it is 1133.982 secs when i am trying to extract 1133.982,it showing me the message..

No regex could be learned. Try providing different examples or restriction
so how can i extract this field

Re: regex formation

Drainy — Fri, 02 Aug 2013 08:36:23 GMT

If you could post an example event one of the community or myself could probably write a regex for you

Re: regex formation

jonuwz — Fri, 02 Aug 2013 11:16:24 GMT

... | rex "(?<cpu_time>\d+(?:\.\d+)?) sec"

This looks for a number, optionally followed by .xxxx follwowd by "sec", and sets a field called cpu_time to the number component of the string.

Re: regex formation

mothmen — Fri, 02 Aug 2013 12:55:23 GMT

Using the regex to get establish field name can be a pretty big pain.

Unless there's a good reason not to, I'd recommend logging the CPU Time within the .log file as something like: "CPU_Time=1133.982" (minus the quotation marks)

Splunk will automatically create the field "CPU_Time" if you log your information this way. It's extremely convenient.