Getting Data In

MVINDEX not working well with SPACE separated values

mrigs
New Member

Hello All,

For an event like this -

CPU    uPct    nPct  sPct  wPct    iPct
all       0.63       0.00       0.38       0.00      98.99
0         0.00       0.00       0.00       0.00     100.00
1         1.00       0.00       0.00       0.00      99.00
2         0.00       0.00       0.00       0.00     100.00
3         0.00       0.00       0.00       0.00     100.00

I want to extract the iPct value for the all row. For some reason my split and mvindex commands are not working properly. This is what I have tried -

*<base search>*
| rex field=_raw "all(?<cpuUsage>.*)\\n"
| eval cpuFields = split(cpuUsage, " ")
| eval cpuIdle = mvindex(cpuFields,4)
| table _time, cpuIdle

The separation works fine, but may be I am doing something wrong with the mvindex? Please advise!

Thank you
M

0 Karma

DalJeanis
Legend

The problem might be that there are multiple spaces between the values.

Since you only want the last value on the line, this would be simpler.

 *<base search>*
 | rex field=_raw "all.*\s(?<cpuIdle>\S+)$"

...or if you wanted everything on the all line...

 | rex "^(?<CPU>all)\s+(?<uPct>\S+)\s+(?<nPct>\S+)\s+(?<sPct>\S+)\s+(?<wPct>\S+)\s+(?<iPct>\S+)$"

...or on all lines...

 | rex "^(?<CPU>\S+)\s+(?<uPct>\S+)\s+(?<nPct>\S+)\s+(?<sPct>\S+)\s+(?<wPct>\S+)\s+(?<iPct>\S+)$"
0 Karma

mrigs
New Member

Thank you. A bit crude, but this worked for me -

| rex field=_raw "all(?:.*) (?<cpuIdle>([0-9]|\.)+)\\n"

It would still be interesting to find out why my SPLIT didn't work as expected!

0 Karma

Sukisen1981
Champion

what does cpuidle return for you?
i think maybe, you need to use -
| eval cpuIdle = mvindex(cpuFields,5) to get ipct values?
Can you please post a screen shot of what your CURRENT query returns?

0 Karma

mrigs
New Member

My cpuidle shows up blank.

_time                   cpuUsage                    cpuFields   cpuIdle
2017-10-04 22:00:17     2.02 0.00 1.01 0.00 96.97   2.02    
                                                    0.00
                                                    1.01
                                                    0.00
                                                    96.97
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...