Getting Data In

Multiline Event with Values

trever
Loves-to-Learn

I have an event that is multiple lines:

Mon May  4 22:06:47 PDT 2020
/dev/sdb1       13245631 12450471    127548  99% /Volumes/Media
/dev/sdd2        9460988  7196839   1787272  81% /Volumes/Media 2

I'm trying to turn it into something that I can monitor over time in a time chart but I'm having trouble getting this split up properly. I tried this:

index=sysmon | rex max_match=0 (?<event>.*)\N | rex max_match=0 \/dev\/(?<drive>\w+)\s*(?<blocks>\d+)\s*(?<used>\d+)\s*(?<available>\d+)\s*(?<usepcnt>\d+)%\s*(?<mounted>.*) | timechart span=30m values(used) by drive

It starts to look right in the table, I have time and values but they are all grouped together still:

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The max_match option of rex produces multi-value fields. You must use mvexpand to create separate events for each value. Perhaps this run-anywhere query will help.

| makeresults 
| eval raw="Mon May  4 22:06:47 PDT 2020
 /dev/sdb1       13245631 12450471    127548  99% /Volumes/Media
 /dev/sdd2        9460988  7196839   1787272  81% /Volumes/Media 2" 
| rex field=raw max_match=0 (?<event>.*)\N 
| mvexpand event
| rex field=event max_match=0 \/dev\/(?<drive>\w+)\s*(?<blocks>\d+)\s*(?<used>\d+)\s*(?<available>\d+)\s*(?<usepcnt>\d+)%\s*(?<mounted>.*)
| timechart span=30m values(used) by drive
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The max_match option of rex produces multi-value fields. You must use mvexpand to create separate events for each value. Perhaps this run-anywhere query will help.

| makeresults 
| eval raw="Mon May  4 22:06:47 PDT 2020
 /dev/sdb1       13245631 12450471    127548  99% /Volumes/Media
 /dev/sdd2        9460988  7196839   1787272  81% /Volumes/Media 2" 
| rex field=raw max_match=0 (?<event>.*)\N 
| mvexpand event
| rex field=event max_match=0 \/dev\/(?<drive>\w+)\s*(?<blocks>\d+)\s*(?<used>\d+)\s*(?<available>\d+)\s*(?<usepcnt>\d+)%\s*(?<mounted>.*)
| timechart span=30m values(used) by drive
---
If this reply helps you, Karma would be appreciated.
0 Karma

trever
Loves-to-Learn

That did exactly what I was looking for! Thank you!

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...