Other Usage

How to create a splunk query for the following problem?

suvi6789
Path Finder

Hi , 

Below is my raw data 

{

timestamp: 2023-09-10

Version:1

Kubernetes.namespace: X

Kubernetes.node: Y

App_id:12345

Host: server.ms.com

Log:  21:46:32.268 [[Runtime].uber.471: [dasda-dasf-fasfs-import-1.0.0].vmstats.com] INFO net.das.com - ProcessCPUload=2.39| SystemCPUload=2.55|Initial memory=1.00| Usedheapmemory=0.70|Maxheap memory=0.95|commited_memory=0.95

S_sourcetype=x

Source=lkms

}

Now, If query as index=123 | table log --> I get the complete data in the log field but my aim to create a table with columns as  ProcessCPUload, SystemCPUload, Usedheapmemory, Maxheap memory, commited_memory with their respective values. 

Could you help on how could I achieve this please

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use this rex statement

| rex field=Log "ProcessCPUload=(?<ProcessCPUload>[\d\.]*).+SystemCPUload(?<SystemCPUload>[\d\.]*).+Usedheapmemory=(?<Usedheapmemory>[\d\.]*).+Maxheap memory=(?<MaxheapMemory>[\d\.]*).+commited_memory=(?<commited_memory>[\d\.]*)"

It will generate a bunch of field names and assumes the format of the data will be as shown - if the order of the fields changes in the log, this will not work

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use this rex statement

| rex field=Log "ProcessCPUload=(?<ProcessCPUload>[\d\.]*).+SystemCPUload(?<SystemCPUload>[\d\.]*).+Usedheapmemory=(?<Usedheapmemory>[\d\.]*).+Maxheap memory=(?<MaxheapMemory>[\d\.]*).+commited_memory=(?<commited_memory>[\d\.]*)"

It will generate a bunch of field names and assumes the format of the data will be as shown - if the order of the fields changes in the log, this will not work

suvi6789
Path Finder

Ho Bowesmana,
Many thanks for the update. This has fixed my issue and I was able to generate the report that I needed 😊.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If this solution helped, please mark it as a solution so others can benefit.

0 Karma

suvi6789
Path Finder

Yes, The suggested solution  has worked.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...