topic Re: Regex multiple fields extraction and graph in Splunk Search

Regex multiple fields extraction and graph

nirt — Sun, 05 Aug 2012 09:21:49 GMT

Hi All,
I have a website which produces statistics and it is shown like this(over 1K lines, so just pasting a few)
Each line is produced for each server(e.g there are 2/3 servers) which are seperated by
:

<3>
null

<2>
RealDBMisc.aborted.hod.-1.number = 0
RealDBMisc.aborted.hod.-1.total = 0
RealDBMisc.aborted.hod.-1.avarage = 0
UserDBMisc.aborted.hod.-1.number = 0
UserDBMisc.aborted.hod.-1.avarage = 0
UserDBMisc.aborted.hod.-1.total = 0
ipc.Routing.RouteCostRequest.success.hod.-1.total = 15204
ipc.vs-changeVenueProduct.success.hod.-1.number = 82

The statistics are for the past hour, so the collection is also per hour
I'm looking for a regex syntax to help me filter fields and create graphs, for example I want a graph to show me the numbers after UserDBMisc.aborted.hod.-1.avarage for a custom time

Thanks in advance

Re: Regex multiple fields extraction and graph

sandeep_at_func — Sun, 05 Aug 2012 16:08:01 GMT

I'm a little fuzzy on understanding this one, is that one event? It might help (me and others) to see what three events would like like from this source. I'm sure we can figure it out 🙂

Re: Regex multiple fields extraction and graph

nirt — Mon, 06 Aug 2012 05:15:53 GMT

One event gives out over 1000 lines of data, each line is a statistic event, however those events can be in multiple servers(divided by the such as <2>)
I need somehow to tell Splunk to know those fields so I can create graphs on each field as I wish

Thanks

Re: Regex multiple fields extraction and graph

nirt — Mon, 06 Aug 2012 08:26:18 GMT

Small correction:
I have a source that gives a lot of statistic information, each line is different content
for example:
pc.DDBRemoveCache.alerts.success.hod.-1.total = 527
ipc.DDBRemoveCache.alerts.success.hod.-1.avarage = 1
ipc.DDBRemoveCache.alerts.success.hod.-1.number = 527
ipc.DDBUpdateCache.alerts.success.hod.-1.number = 161
ipc.DDBUpdateCache.alerts.success.hod.-1.total = 161
ipc.DDBUpdateCache.alerts.success.hod.-1.avarage = 1

so it's quite simple: name = value
but I can't seem to get the regex properly working

Re: Regex multiple fields extraction and graph

ayme — Mon, 06 Aug 2012 11:27:58 GMT

Something like this?:

sourcetype=yourdata | rex max_match=99999 field=your_field_holding_all_values "(?<yourfield>[^\n]+)"  | mvexpand yourfield | search yourfield="ipc.DDBRemoveCache.alerts.success.hod.-1.total*" | rex field=yourfield "(?P<field>[^\=]+)=(?P<value>.*)" | table field, value