Getting Data In

Multiline Event with Values

New Member

I have an event that is multiple lines:

Mon May  4 22:06:47 PDT 2020
/dev/sdb1       13245631 12450471    127548  99% /Volumes/Media
/dev/sdd2        9460988  7196839   1787272  81% /Volumes/Media 2

I'm trying to turn it into something that I can monitor over time in a time chart but I'm having trouble getting this split up properly. I tried this:

index=sysmon | rex max_match=0 (?<event>.*)\N | rex max_match=0 \/dev\/(?<drive>\w+)\s*(?<blocks>\d+)\s*(?<used>\d+)\s*(?<available>\d+)\s*(?<usepcnt>\d+)%\s*(?<mounted>.*) | timechart span=30m values(used) by drive

It starts to look right in the table, I have time and values but they are all grouped together still:

alt text

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The max_match option of rex produces multi-value fields. You must use mvexpand to create separate events for each value. Perhaps this run-anywhere query will help.

| makeresults 
| eval raw="Mon May  4 22:06:47 PDT 2020
 /dev/sdb1       13245631 12450471    127548  99% /Volumes/Media
 /dev/sdd2        9460988  7196839   1787272  81% /Volumes/Media 2" 
| rex field=raw max_match=0 (?<event>.*)\N 
| mvexpand event
| rex field=event max_match=0 \/dev\/(?<drive>\w+)\s*(?<blocks>\d+)\s*(?<used>\d+)\s*(?<available>\d+)\s*(?<usepcnt>\d+)%\s*(?<mounted>.*)
| timechart span=30m values(used) by drive
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The max_match option of rex produces multi-value fields. You must use mvexpand to create separate events for each value. Perhaps this run-anywhere query will help.

| makeresults 
| eval raw="Mon May  4 22:06:47 PDT 2020
 /dev/sdb1       13245631 12450471    127548  99% /Volumes/Media
 /dev/sdd2        9460988  7196839   1787272  81% /Volumes/Media 2" 
| rex field=raw max_match=0 (?<event>.*)\N 
| mvexpand event
| rex field=event max_match=0 \/dev\/(?<drive>\w+)\s*(?<blocks>\d+)\s*(?<used>\d+)\s*(?<available>\d+)\s*(?<usepcnt>\d+)%\s*(?<mounted>.*)
| timechart span=30m values(used) by drive
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

That did exactly what I was looking for! Thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!