topic Re: How to use rex to extract Linux directory sizes and names? in Splunk Search

How to use rex to extract Linux directory sizes and names?

edwinmae — Tue, 17 May 2016 10:57:52 GMT

I run a daily script on the server, du -sk, against a certain directory that contains 200 subdirectories and write that to a .txt file

Example output (of the .txt file)

1000 name1 (1000 = size (total) and name1 = subdirectory)
1100 name2
1200 name3

In Splunk this shows in a similar way as above
Time and Event (Event data is 1000 name1) -- example --

Next line = 1100 name2, etc. --- every line looks like a 'separate' event (=line) in Splunk --

Now when I try to Extract new fields it throws:

Error in 'rex' command: Encountered the following error while compiling the regex '(?i)^(?P[^\t]+)': Regex: syntax error in subpattern name (missing terminator)

Target is to show the output in a graph (likely in MB or GB) per 'subdirectory'. I saw a similar case, but I was not able to re-produce the solution that was stated.

There is very likely a very simple solution for this to separate the e.g. 1000 from the name1, but I have not succeeded myself -- Yeah I know 🙂

Re: How to use rex to extract Linux directory sizes and names?

richgalloway — Tue, 17 May 2016 13:34:06 GMT

There's no need for the (?i) flag since your regex does not contain alphas. This command will extract the directory size and name.

... | rex "(?<size>\d+)\s+(?<dir>\w+)" | ...

Re: How to use rex to extract Linux directory sizes and names?

edwinmae — Thu, 19 May 2016 05:09:58 GMT

Worked -- Thanks!

Re: How to use rex to extract Linux directory sizes and names?

edwinmae — Mon, 23 May 2016 07:08:07 GMT

Additional question 'to the same scenario': If we would have the following (within the same event)

1000 dir1
1200 dir2
1550 dir3
Etc.

 .... | rex "(?<size>\d+)\s+(?<dir>\w+)" | eval GB=(size/1024)/1024 | timechart mode(GB) as Size by dir

This will give me only the first line, which is 1000 and dir1. How do I extract the sample above so that I have different events for all (directories and total values)?