Splunk Enterprise

EXTRACTION OF FIELDS

sphiwee
Communicator

Can I please get the extraction of "14%" as memory used & "boot" as directory, thank you. 


[2020-11-17 11:33:43+0200] Filesystem Size Used Avail Use% Mounted on /dev/sda1 2.0G 274M 1.8G 14% /boot

Labels (1)
Tags (1)
0 Karma
1 Solution

inventsekar
Super Champion

 

"\d+ --- one or more digits.... (it will match for 5%, 15% and 150% as well)"

|makeresults | eval log="[2020-11-17 11:33:43+0200] Filesystem Size Used Avail Use% Mounted on /dev/sda1 2.0G 274M 1.8G 14% /boot" 
| rex field=log "(?<memoryUsed>\d+\%)\s(?<directory>.*)$" | table memoryUsed directory

 

rex-percentage.jpg

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

View solution in original post

inventsekar
Super Champion

Hi @sphiwee if the issue resolved, can you please accept the above one as the solution.. if still there are any issues, pls let us know. thanks. 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

inventsekar
Super Champion

 

"\d+ --- one or more digits.... (it will match for 5%, 15% and 150% as well)"

|makeresults | eval log="[2020-11-17 11:33:43+0200] Filesystem Size Used Avail Use% Mounted on /dev/sda1 2.0G 274M 1.8G 14% /boot" 
| rex field=log "(?<memoryUsed>\d+\%)\s(?<directory>.*)$" | table memoryUsed directory

 

rex-percentage.jpg

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

sphiwee
Communicator

Am I able to convert that 14% to a piechart that shows only 14% space used? and how? kinda struggling to do it

0 Karma

sphiwee
Communicator

 

How do i get rid of the empty spaces above

sphiwee_0-1605611728434.png

 

0 Karma

inventsekar
Super Champion

Hi @sphiwee the empty spaces meaning no matches, .. did the splunk search matched on all logs? all the logs are in the same format ? 

please update the search query last portion...  "| table memoryUsed directory _raw"... so for the empty space, corresponding log lines can be seen.. copy paste those lines please...

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

sphiwee
Communicator

Hi @inventsekar 

 

i was able to fix it with this 

 

"| search memoryUsed=* OR directory=*" 

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...