topic How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event? in Splunk Search

How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event?

pkudrle — Tue, 08 Dec 2015 17:28:56 GMT

Here is the logged event:

SepsisGraphBuilderImpl: 11252495 MS
  VitalsGraphBuilderImpl: 2257 MS
  Mic2GraphBuilder: 358360 MS
  RasGraphBuilderImpl: 201 MS
  PatientInfoGraphBuilder: 1992 MS
  InterventionEventGraphBuilderImpl: 372 MS
  ObservationInfoGraphBuilder: 42472 MS
  DrugOrderGraphBuilder: 31849 MS

  SurgeryAndRadiologyGraphBuilder: 232 MS

I am wanting to grab each graphbuilder and the time in MS. I thought this search would work, but I am only getting Mic2GraphBuilder:

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder*): (?<totalms>\d+) MS" | table object, totalms

Re: How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event?

richgalloway — Tue, 08 Dec 2015 17:54:13 GMT

Your regex is looking for words that end with "GraphBuilde" and any number of r's on the end. Try this

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS" | table object, totalms

If you have one graphbuilder/time pair per event then this will work. If you have multiple pairs per event then you will have to add max_match=0 to the rex command and then process the object and totalms fields as multi-valued fields.

Re: How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event?

acharlieh — Wed, 09 Dec 2015 01:20:43 GMT

Without a Splunk in front of me, I wonder if it's actually be easier to use extract with perhaps untable something like...

host=s*gs* *GraphBuilder* | extract kvdelim=":" | untable _time object totalms

There may be some eval to clean up but it seems like it'd be easier than fighting regular expressions to make multi valued fields.

Re: How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event?

pkudrle — Wed, 09 Dec 2015 14:32:04 GMT

how do you then parse the multi-valued fields as pairs?

Re: How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event?

richgalloway — Wed, 09 Dec 2015 14:45:11 GMT

You combine the two multi-valued fields and then expand them into separate events. Then you process each event as you normally would. Something like this.

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS"  | eval pairs=mvzip(object,totalms) | mvexpand pairs | ...

Re: How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event?

pkudrle — Wed, 09 Dec 2015 17:00:23 GMT

Unfortunately there is some text before and afterwards that interfere