topic Re: Splunk Query in Splunk Search

Splunk Query

DTERM — Mon, 28 Sep 2020 13:09:46 GMT

I'm trying to extract a single field from a log and perform some statistical calculations using stats.

The log entries I have look like the following:

"Jan 22 16:43:48 10.164.93.7 10.164.93.7 local2 warn rpd[1106]: RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path  (lsp B.R2.CHI-1) bandwidth changed, path bandwidth 81659056 bps","2013-01-22T11:43:48.000-0500",,16,22,43,january,48,tuesday,2013,local,"nix-all-logs",local2,"log.itgh.net",,"syslog_prod",1,22,"C-NET","10.164.93.7","10.164.93.7","R1.BB-FO.BRN1",Jan,"16:43:48","RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path  (lsp R1.CHI2-1) bandwidth changed, path bandwidth 81659056 bps",,"__::_..._...___[]:_:____(_-.-.-)__,____",warn,"/app/syslog/10.164.93.7/10.164.93.7.log","syslog_vrsn","splunk6",,16,7

The query I'm using is:

index=syslog_data bandwidth | extract pairdelim="bandwidth", kvdelim="bps", auto=f

does not extract the bandwidth number, in the above example, I just want to extract the number 81659056

I can user the IFX to extract the field, but then the extracted field looks like:

    1   0.877193

5 RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path (lsp R6.NYC.LAX3-1) bandwidth changed, path bandwidth 75085360 bps

What is the best way to extract just the bandwidth from the entry?

Thanks in advance.

Re: Splunk Query

sdaniels — Tue, 22 Jan 2013 19:01:25 GMT

As long as you have the line breaking correct for the events in Splunk than a regex like this

(?<=bandwidth\s)\d+(?=\s)

to replace what IFX is coming up with should work. Just go into the config file and change it directly or if you've already deleted it, replace it in the IFX when you create the extraction.

Re: Splunk Query

chris — Tue, 22 Jan 2013 19:06:58 GMT

Is there a reason why you are using extract? You could just use rex if the bandwidth is the only field you need:

index=syslog_data bandwidth | rex "bandwidth\s(?<my_bandwidth>\d+)\sbps"

Chris

Re: Splunk Query

DTERM — Tue, 22 Jan 2013 19:27:53 GMT

Perfect, gotta learn SPLUNK regex! Thanks!

Re: Splunk Query

chris — Tue, 22 Jan 2013 21:39:55 GMT

You're welcome