I have been dumped with events what appears to be memory info.
memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS
92101 66926 7175 77.6 21.4 3497702952 3.6 909526 998772788 4232481396 16909785 302 1012 4.07 0.00 7876.48 341.04 41.79
I am supposed to display it in a tabular format like memTotalMB, memFreeMB etc... as the headers and 9201 , 66926 etc.. as their values . Could anyone help me with the query please ?
Give this a try:
| makeresults
| eval _raw="memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS
92101 66926 7175 77.6 21.4 3497702952 3.6 909526 998772788 4232481396 16909785 302 1012 4.07 0.00 7876.48 341.04 41.79"
| rex "[\s](?P<memTotalMB>\d+\.?\d+)\s+(?P<memFreeMB>\d+\.?\d+)\s+(?P<memUsedMB>\d+\.?\d+)\s+(?P<memFreePct>\d+\.?\d+)\s+(?P<memUsedPct>\d+\.?\d+)\s+(?P<pgPageOut>\d+\.?\d+)\s+(?P<swapUsedPct>\d+\.?\d+)\s+(?P<pgSwapOut>\d+\.?\d+)\s+(?P<cSwitches>\d+\.?\d+)\s+(?P<interrupts>\d+\.?\d+)\s+(?P<forks>\d+\.?\d+)\s+(?P<processes>\d+\.?\d+)\s+(?P<threads>\d+\.?\d+)\s+(?P<loadAvg1mi>\d+\.?\d+)\s+(?P<waitThreads>\d+\.?\d+)\s+(?P<interrupts_PS>\d+\.?\d+)\s+(?P<pgPageIn_PS>\d+\.?\d+)\s+(?P<pgPageOut_PS>\d+\.?\d+)"
| table *
You only need the "| rex" portion of the search above just put your generating commands before it and visualization commands after it.
Give this a try:
| makeresults
| eval _raw="memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS
92101 66926 7175 77.6 21.4 3497702952 3.6 909526 998772788 4232481396 16909785 302 1012 4.07 0.00 7876.48 341.04 41.79"
| rex "[\s](?P<memTotalMB>\d+\.?\d+)\s+(?P<memFreeMB>\d+\.?\d+)\s+(?P<memUsedMB>\d+\.?\d+)\s+(?P<memFreePct>\d+\.?\d+)\s+(?P<memUsedPct>\d+\.?\d+)\s+(?P<pgPageOut>\d+\.?\d+)\s+(?P<swapUsedPct>\d+\.?\d+)\s+(?P<pgSwapOut>\d+\.?\d+)\s+(?P<cSwitches>\d+\.?\d+)\s+(?P<interrupts>\d+\.?\d+)\s+(?P<forks>\d+\.?\d+)\s+(?P<processes>\d+\.?\d+)\s+(?P<threads>\d+\.?\d+)\s+(?P<loadAvg1mi>\d+\.?\d+)\s+(?P<waitThreads>\d+\.?\d+)\s+(?P<interrupts_PS>\d+\.?\d+)\s+(?P<pgPageIn_PS>\d+\.?\d+)\s+(?P<pgPageOut_PS>\d+\.?\d+)"
| table *
You only need the "| rex" portion of the search above just put your generating commands before it and visualization commands after it.
Hi @zacksoft,
Try this query:
index=<index_name> | rex field=raw "\s+[^\d]+1[^\d]+\s+(?<values>[\d\s.]+)" | makemv delim=" " values | eval memTotalMB=mvindex(values, 0),memFreeMB=mvindex(values, 1),memUsedMB=mvindex(values, 2),memFreePct=mvindex(values, 3),memUsedPct=mvindex(values, 4),pgPageOut=mvindex(values, 5),swapUsedPct=mvindex(values, 6),pgPageIn_PS=mvindex(values, 16),pgPageOut_PS=mvindex(values, 17)
is it a single event containing both field names and values? Please post some more events. This looks like a tsv event, it should be parsed before indexing. TSV extractions can be done using props.conf in forwarders.
Can't we use REX to parse it on user side. We have no option to do it (restricted by admin).
All the events look identical, just like the one I posted. Could you assist with some parsing to extract the info