topic Re: Get numbers between event in Splunk Search

Get numbers between event

pudanelilita — Fri, 23 Aug 2019 13:37:02 GMT

Hi,
I would like to get Heap number, from event:
[Eden: 704.0M(5804.0M)->0.0B(5800.0M) Survivors: 52.0M->56.0M Heap: 7961.8M(15.0G)->7271.4M(15.0G)]

And get:
7961.8

Re: Get numbers between event

skoelpin — Fri, 23 Aug 2019 14:15:30 GMT

Add this, your field name will be called HeapNum

| rex Heap:\s(?<HeapNum>\d+\.\d)\w

Re: Get numbers between event

pudanelilita — Fri, 23 Aug 2019 14:39:17 GMT

Thanks you a lot @skoelpin !
And, if I want to take number, which is in () brackets?

Re: Get numbers between event

skoelpin — Fri, 23 Aug 2019 14:41:18 GMT

If the number is in the parenthesis and you want to exclude it, you would do something like this

| rex Heap:\s\((?<HeapNum>\d+\.\d)\)\w

Re: Get numbers between event

pudanelilita — Fri, 23 Aug 2019 15:06:15 GMT

Thank you for your replay, @skoelpin !
But if before parenthesis there is numbe like this Heap: 12.8G(15.0G), and 12.8 all the time is changing, and I need 15.0?

Re: Get numbers between event

pudanelilita — Mon, 26 Aug 2019 08:13:03 GMT

Also for some reason, when I try with Metaspace, it shows no outputs.
Event:
[Eden: 180.0M(6104.0M)->0.0B(6104.0M) Survivors: 0.0B->0.0B Heap: 3159.0M(12.0G)->2979.3M(12.0G)], [Metaspace: 535433K->535433K(1574912K)]

| rex Metaspace:\s(?\d+\.\d)\w | table metaspacenum | head 10

output in Statics there there is noting, just empty tables
tried to exclude with | search metaspacenum!=" "
but it didn't helped

Re: Get numbers between event

skoelpin — Mon, 26 Aug 2019 13:19:13 GMT

Like this

| rex Metaspace:\s(?<Metaspace>\d+)

To exclude nulls, like this

| where isnotnull(Metaspace)