Using rex to extract a field from transactioned event

markthompson — Thu, 12 Mar 2015 15:07:10 GMT

Hi,
I'm trying to extract 2 fields from a transacted search, one for the max and one for the usage.

looks like;

2015-03-12 12:10:11,180 INFO metrics - type=GAUGE, name=heap.max, value=1908408320
2015-03-12 12:10:11,181 INFO metrics - type=GAUGE, name=heap.used, value=82831232

Re: Using rex to extract a field from transactioned event

markthompson — Thu, 12 Mar 2015 15:07:45 GMT

I have solved this by using;

rex field=_raw "name=heap.max, value=(?<Max>\S+)" | rex field=_raw "name=heap.used, value=(?<Used>\S+)"

topic Using rex to extract a field from transactioned event in Splunk Search

Using rex to extract a field from transactioned event

Re: Using rex to extract a field from transactioned event