Splunk Search

Duplicate nested KV's

mjones414
Contributor

Resource_list_select=ncpus=24:mpiprocs=2:node_class=n24.48+7:ncpus=24:mpiprocs=1:node_class=n24.48

Every once in a while I get an event when there was a problem with an application that this fields data gets duplicate fields appended.

The pieces I'm wanting to pull out of this into individual fields are node_class and ncpu's, but whenever there was an unexpected problem it appends a +with a number and repeats the field.

The rex I've been working on is: ..| rex field=Resource_List_select "\d:node_class=(?.*\d.[0-9]\d)" This grabs the first instance of node_class or ncpu respectively but when there is duplicate entries in the field for each nested field, thats where it gets confused.

How could I revise this regex to grab node_class=n##.## and stop before it gets to a + sign? whenever the data is formatted correctly the delimiter would be the :

Tags (2)
0 Karma
1 Solution

mjones414
Contributor

Success!
rex field=Resource_List_select "(?i):node_class=(?P[^ /+/:]+)"

View solution in original post

mjones414
Contributor

Success!
rex field=Resource_List_select "(?i):node_class=(?P[^ /+/:]+)"

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...