Splunk Search

Duplicate nested KV's

mjones414
Contributor

Resource_list_select=ncpus=24:mpiprocs=2:node_class=n24.48+7:ncpus=24:mpiprocs=1:node_class=n24.48

Every once in a while I get an event when there was a problem with an application that this fields data gets duplicate fields appended.

The pieces I'm wanting to pull out of this into individual fields are node_class and ncpu's, but whenever there was an unexpected problem it appends a +with a number and repeats the field.

The rex I've been working on is: ..| rex field=Resource_List_select "\d:node_class=(?.*\d.[0-9]\d)" This grabs the first instance of node_class or ncpu respectively but when there is duplicate entries in the field for each nested field, thats where it gets confused.

How could I revise this regex to grab node_class=n##.## and stop before it gets to a + sign? whenever the data is formatted correctly the delimiter would be the :

Tags (2)
0 Karma
1 Solution

mjones414
Contributor

Success!
rex field=Resource_List_select "(?i):node_class=(?P[^ /+/:]+)"

View solution in original post

mjones414
Contributor

Success!
rex field=Resource_List_select "(?i):node_class=(?P[^ /+/:]+)"

Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...