- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a lot of lines in the following format:
CPU: 2.7GHz, 2, 'Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz', OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: 'HP EliteBook Folio 9480m', 'Hewlett-Packard'
I get this list with: "CPU: earliest=-1h"
I am trying to create a dashboard/graph showing statistics on what OS and CPU customers use mostly.
How do I achieve this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
Try something like this
index=foo sourcetype=bar "CPU:" earliest=-1h | rex "CPU:\s+(?<CPU>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use somesoni2's rex statement to pull out the fields but then depending on how you want to present the data you could do a simple stats command
... | dedup host | stats count by CPU OS | sort -count
Based on your query I'm guessing the data is generated every hour? Dedup is good though if the data is generated sporadically and you search over a longer period of time there can be more efficient ways to get the most recent data from each system. This also assumes you are saying "showing statistics on what combination OS and CPU customers use mostly"
A good resource to use for making regular expressions is regex101.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
Try something like this
index=foo sourcetype=bar "CPU:" earliest=-1h | rex "CPU:\s+(?<CPU>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks. One more question: What would I need to add to the rex string to get RAM if I have a log like this:
CPU: 2.5GHz, 2, 'Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz', RAM(total): 7879MB, RAM(free): 3738MB, OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: '20AN0069US', 'LENOVO'
I would be interested in RAM(total) and RAM(free)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
The regex is created in the same order they appear in the data, so for your sample logs, the rex command will be like this
| rex "CPU:\s+(?<CPU>.+),\s+RAM\(total\):\s+(?<RAM_total>.+),\s+RAM\(free\):\s+(?<RAM_free>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)