How to create rex for multiple fields?

Veeru — Mon, 06 Jun 2022 03:50:06 GMT

Hello
Good Day!
I have the events in the raw data where i want to extract the drive information into few field and convert into gb

event1:C:\Windows\system FreeSpace DeviceID FreeSpace
C: 36247773184

😧 96900616192

E: 26285309952

event2:C:\Windows\system DeviceID FreeSpace
C: 36247773184

😧 96900616192

event3:C:\Windows\system DeviceID FreeSpace
C: 36247773184

event4:C: 36247773184

😧 96900616192

E: 26285309952

My Query:
index=A
|rex "(?<Drive>\S+:\s+\d+)"
|stats values(Drive) by host _raw

My output:

Host

_raw

Drive

C:\Windows\system FreeSpace DeviceID FreeSpace
C: 36247773184

😧 96900616192

E: 26285309952

C: 36247773184

C:\Windows\system FreeSpace DeviceID FreeSpace
C: 36247773184

😧 96900616192

C: 36247773184

I am getting only first values .But i want to get a the values from the raw event and want to convert the digital value into gb
Please help me on that

Thank you
Veeru

"Happy Splunking"

Re: Rex for multiple fields

Roy_9 — Sun, 05 Jun 2022 17:40:27 GMT

Hello @Veeru

Can you try as following:
| eval GB=round(b/1024/1024/1024, 3)

Thanks

Re: Rex for multiple fields

PickleRick — Sun, 05 Jun 2022 17:43:19 GMT

You can match multiple times with max_match option for the rex command.

| rex max_match=0 "(?<Drive>..."

Re: Rex for multiple fields

ITWhisperer — Sun, 05 Jun 2022 17:44:52 GMT

|rex max_match=0 "(?<Drive>\S+):\s+(?<size>\d+)"

topic Re: Rex for multiple fields in Splunk Search

How to create rex for multiple fields?

Re: Rex for multiple fields

Re: Rex for multiple fields

Re: Rex for multiple fields