Extract selected fields from .txt

[vickram]

Hi All,
I Need to extract " CURDEPTH(553)" and "MAXDEPTH(15000)" as two seperate fields from the below .txt file (below is the sample stanza). Can you please help.

Thanks in advance.

1 : dis ql('PAPL.ESB.FDS.DELIVERYCONSTRUCT.QUEUE.ESBFDSIns1') curdepth,maxdepth
AMQ8409: Display Queue details.
QUEUE(PAPL.ESB.FDS.DELIVERYCONSTRUCT.QUEUE.ESBFDSIns1)
TYPE(QLOCAL) CURDEPTH(553)
MAXDEPTH(15000)

One MQSC command read.
No commands have a syntax error.
All valid MQSC commands were processed.
5724-H72 (C) Copyright IBM Corp. 1994, 2015.
Starting MQSC for queue manager PAPL_ESB_FDS_PRD_QM_223.

[vickram]

index=aiam_mywizard_esb_queuedepth_analysis
|rex "(?i)MAXDEPTH((?P[^)]+)"
|rex "(?i)CURDEPTH((?P[^)]+)"
|rex "(?i)QUEUE((?P[^)]+)"
|rex "(?i)TYPE((?P[^)]+)"
| table Maxdepth Curdepth Queue type

Thanks for the help. I have made the above query. I need to calculate the percentage of the "Maxdepth" field and compare with the "Curdepth" field and find the event When the "Curdepth" reaches 75% of the "Maxdepth".
Can you please help on this.

[vik_splunk · Accepted solution]

HI @vickram , The below should work for you.

<base search>|rex "(?i)MAXDEPTH\((?P<Maxdepth>[^\)]+)"|rex "(?i)CURDEPTH\((?P<Curdepth>[^\)]+)"|stats count by Maxdepth,Curdepth

[vickram]

Thanks for the help vik

[vickram]

index=aiam_mywizard_esb_queuedepth_analysis
|rex "(?i)MAXDEPTH((?P[^)]+)"
|rex "(?i)CURDEPTH((?P[^)]+)"
|rex "(?i)QUEUE((?P[^)]+)"
|rex "(?i)TYPE((?P[^)]+)"
| table Maxdepth Curdepth Queue type

Thanks for the help. I have made the above query. I need to calculate the percentage of the "Maxdepth" field and compare with the "Curdepth" field and find the event When the "Curdepth" reaches 75% of the "Maxdepth".
Can you please help on this.

[vik_splunk]

Add the below after the current query @vickram

|eval Percentage=(Curdepth/Maxdepth)*100|where Percentage>=75

[diogofgm]

In search you can use:

| rex "CURDEPTH\((?<cur_depth>[^\)]+)\)"
| rex "MAXDEPTH\((?<max_depth>[^\)]+)\)"

in props you can use the same regex in a EXTRACT-field = ...

[vickram]

Works perfectly 😉 thanks much

[vickram]

index=aiam_mywizard_esb_queuedepth_analysis
|rex "(?i)MAXDEPTH((?P[^)]+)"
|rex "(?i)CURDEPTH((?P[^)]+)"
|rex "(?i)QUEUE((?P[^)]+)"
|rex "(?i)TYPE((?P[^)]+)"
| table Maxdepth Curdepth Queue type

Thanks for the help. I have made the above query. I need to calculate the percentage of the "Maxdepth" field and compare with the "Curdepth" field and find the event When the "Curdepth" reaches 75% of the "Maxdepth".
Can you please help on this.