Other Usage

How to create a splunk query for the following problem?

suvi6789
Path Finder

Hi , 

Below is my raw data 

{

timestamp: 2023-09-10

Version:1

Kubernetes.namespace: X

Kubernetes.node: Y

App_id:12345

Host: server.ms.com

Log:  21:46:32.268 [[Runtime].uber.471: [dasda-dasf-fasfs-import-1.0.0].vmstats.com] INFO net.das.com - ProcessCPUload=2.39| SystemCPUload=2.55|Initial memory=1.00| Usedheapmemory=0.70|Maxheap memory=0.95|commited_memory=0.95

S_sourcetype=x

Source=lkms

}

Now, If query as index=123 | table log --> I get the complete data in the log field but my aim to create a table with columns as  ProcessCPUload, SystemCPUload, Usedheapmemory, Maxheap memory, commited_memory with their respective values. 

Could you help on how could I achieve this please

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use this rex statement

| rex field=Log "ProcessCPUload=(?<ProcessCPUload>[\d\.]*).+SystemCPUload(?<SystemCPUload>[\d\.]*).+Usedheapmemory=(?<Usedheapmemory>[\d\.]*).+Maxheap memory=(?<MaxheapMemory>[\d\.]*).+commited_memory=(?<commited_memory>[\d\.]*)"

It will generate a bunch of field names and assumes the format of the data will be as shown - if the order of the fields changes in the log, this will not work

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use this rex statement

| rex field=Log "ProcessCPUload=(?<ProcessCPUload>[\d\.]*).+SystemCPUload(?<SystemCPUload>[\d\.]*).+Usedheapmemory=(?<Usedheapmemory>[\d\.]*).+Maxheap memory=(?<MaxheapMemory>[\d\.]*).+commited_memory=(?<commited_memory>[\d\.]*)"

It will generate a bunch of field names and assumes the format of the data will be as shown - if the order of the fields changes in the log, this will not work

suvi6789
Path Finder

Ho Bowesmana,
Many thanks for the update. This has fixed my issue and I was able to generate the report that I needed 😊.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If this solution helped, please mark it as a solution so others can benefit.

0 Karma

suvi6789
Path Finder

Yes, The suggested solution  has worked.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...