Getting Data In

regex to parse event log to metric index

vikashperiwal
Path Finder

Hi ,

 

I am trying to parse the event log in to metric index by using props and transform conf file, but getting issue with my regex format.

 

issue : i am not able to extract fields at index time.

Splunk Version : 7.1.x

transform:

[field_extraction]
REGEX = .*[write]\_log\svalues\:(?<host>\w*.\.\w*\.\w*)\.(?<metric_name>[\w\.\-]*)\s*(?<_value>\d{1,4})\s*(?<id>\d*)
FORMAT = host::$1 $2::$3 id::$4
WRITE_META = true

[metric-schema:extract_metrics]
METRIC-SCHEMA-MEASURES = _ALLNUMS_
METRIC-SCHEMA-WHITELIST-DIMS = host

 

 

Log:

[2020-05-15 22:40:45] [info] write_log values:hostname.abcd.com.cpu-45.percent-nice 20 1648489

 

i want to filter logs out of millions of log with value write_log...where ever i find write_log that should be indexed.

 

my metrics : 

Metric name - cpu-x.percent-nice
Metric value - 30
ID - 1648789
 
Any help is appreciated.
 
Thx
Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I wonder if using unnamed capture groups might help.  Try this

REGEX = write_log\svalues:(\w*.\.\w*\.\w*)\.([\w\.\-]*)\s*(\d{1,4})\s*(\d*)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...