Getting Data In

MVINDEX not working well with SPACE separated values

New Member

Hello All,

For an event like this -

CPU    uPct    nPct  sPct  wPct    iPct
all       0.63       0.00       0.38       0.00      98.99
0         0.00       0.00       0.00       0.00     100.00
1         1.00       0.00       0.00       0.00      99.00
2         0.00       0.00       0.00       0.00     100.00
3         0.00       0.00       0.00       0.00     100.00

I want to extract the iPct value for the all row. For some reason my split and mvindex commands are not working properly. This is what I have tried -

*<base search>*
| rex field=_raw "all(?<cpuUsage>.*)\\n"
| eval cpuFields = split(cpuUsage, " ")
| eval cpuIdle = mvindex(cpuFields,4)
| table _time, cpuIdle

The separation works fine, but may be I am doing something wrong with the mvindex? Please advise!

Thank you

0 Karma


The problem might be that there are multiple spaces between the values.

Since you only want the last value on the line, this would be simpler.

 *<base search>*
 | rex field=_raw "all.*\s(?<cpuIdle>\S+)$"

...or if you wanted everything on the all line...

 | rex "^(?<CPU>all)\s+(?<uPct>\S+)\s+(?<nPct>\S+)\s+(?<sPct>\S+)\s+(?<wPct>\S+)\s+(?<iPct>\S+)$"

...or on all lines...

 | rex "^(?<CPU>\S+)\s+(?<uPct>\S+)\s+(?<nPct>\S+)\s+(?<sPct>\S+)\s+(?<wPct>\S+)\s+(?<iPct>\S+)$"
0 Karma

New Member

Thank you. A bit crude, but this worked for me -

| rex field=_raw "all(?:.*) (?<cpuIdle>([0-9]|\.)+)\\n"

It would still be interesting to find out why my SPLIT didn't work as expected!

0 Karma


what does cpuidle return for you?
i think maybe, you need to use -
| eval cpuIdle = mvindex(cpuFields,5) to get ipct values?
Can you please post a screen shot of what your CURRENT query returns?

0 Karma

New Member

My cpuidle shows up blank.

_time                   cpuUsage                    cpuFields   cpuIdle
2017-10-04 22:00:17     2.02 0.00 1.01 0.00 96.97   2.02    
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...