regex to parse event log to metric index

[vikashperiwal]

Hi ,

I am trying to parse the event log in to metric index by using props and transform conf file, but getting issue with my regex format.

issue : i am not able to extract fields at index time.

Splunk Version : 7.1.x

transform:

[field_extraction]
REGEX = .*[write]\_log\svalues\:(?<host>\w*.\.\w*\.\w*)\.(?<metric_name>[\w\.\-]*)\s*(?<_value>\d{1,4})\s*(?<id>\d*)
FORMAT = host::$1 $2::$3 id::$4
WRITE_META = true

[metric-schema:extract_metrics]
METRIC-SCHEMA-MEASURES = _ALLNUMS_
METRIC-SCHEMA-WHITELIST-DIMS = host

Log:

[2020-05-15 22:40:45] [info] write_log values:hostname.abcd.com.cpu-45.percent-nice 20 1648489

i want to filter logs out of millions of log with value write_log...where ever i find write_log that should be indexed.

my metrics : 

Host - hostname.abc.com

Metric name - cpu-x.percent-nice

Metric value - 30

ID - 1648789

Any help is appreciated.

Thx

[richgalloway]

I wonder if using unnamed capture groups might help.  Try this

REGEX = write_log\svalues:(\w*.\.\w*\.\w*)\.([\w\.\-]*)\s*(\d{1,4})\s*(\d*)