All Apps and Add-ons

Search _internal by Series

hartfoml
Motivator

I have created two letter ID's for my indexes. I would like to know how each index is doing so I search the _internal for the index name like this:
index="_internal" source="*metrics.log" per_index_thruput series="aa"
this will show me the amount of data indexed and I can count or sum or timechart.
I want to do this for all my two letter series but I don't know how to do the search without including all the unwanted series. Somehow I need to restrict the (series="**") to only two letters. All the other series have more than two letters.

0 Karma
1 Solution

Lamar
Splunk Employee
Splunk Employee

Try this:

index=_internal source=*metrics.log group="per_index_thruput" | rex field=series "^(?<good>[a-z_]{2})$" | search good=*

View solution in original post

Lamar
Splunk Employee
Splunk Employee

Try this:

index=_internal source=*metrics.log group="per_index_thruput" | rex field=series "^(?<good>[a-z_]{2})$" | search good=*

hartfoml
Motivator

Thanks that was the key

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...