https://community.splunk.com/t5/Splunk-Search/regular-expression-help/m-p/239421#M71125 <P>Hi,<BR /> i am trying to get metric and respective values using regex</P> <P>can you help us to get corresponding metrics and values like <BR /> Misc:NUM_PROCS = 183<BR /> Misc:NUM_ZOMBIES=0<BR /> Procs:Waiting=0</P> Tue, 29 Sep 2020 12:27:15 GMT rajgowd1 2020-09-29T12:27:15Z https://community.splunk.com/t5/Splunk-Search/regular-expression-help/m-p/239421#M71125 <P>Hi,<BR /> i am trying to get metric and respective values using regex</P> <P>can you help us to get corresponding metrics and values like <BR /> Misc:NUM_PROCS = 183<BR /> Misc:NUM_ZOMBIES=0<BR /> Procs:Waiting=0</P> Tue, 29 Sep 2020 12:27:15 GMT https://community.splunk.com/t5/Splunk-Search/regular-expression-help/m-p/239421#M71125 rajgowd1 2020-09-29T12:27:15Z https://community.splunk.com/t5/Splunk-Search/regular-expression-help/m-p/239422#M71126 <P>Since your logs is json and/or has key-value pair, the fields name and value should already be extracted. To list them try something like this</P> <PRE><CODE>your base search | eval {name}=value | table _time "HealthCheck|*" | rename "HealthCheck|*" as * </CODE></PRE> <P>To chart the values (choose a aggregation function to use e.g. avg, max, min etc. The example uses avg)</P> <PRE><CODE>your base search | eval {name}=value | table _time "HealthCheck|*" | rename "HealthCheck|*" as * | timechart avg(*) as * </CODE></PRE> Mon, 16 Jan 2017 19:16:04 GMT https://community.splunk.com/t5/Splunk-Search/regular-expression-help/m-p/239422#M71126 somesoni2 2017-01-16T19:16:04Z