Splunk Search

Duplicate nested KV's

mjones414
Contributor

Resource_list_select=ncpus=24:mpiprocs=2:node_class=n24.48+7:ncpus=24:mpiprocs=1:node_class=n24.48

Every once in a while I get an event when there was a problem with an application that this fields data gets duplicate fields appended.

The pieces I'm wanting to pull out of this into individual fields are node_class and ncpu's, but whenever there was an unexpected problem it appends a +with a number and repeats the field.

The rex I've been working on is: ..| rex field=Resource_List_select "\d:node_class=(?.*\d.[0-9]\d)" This grabs the first instance of node_class or ncpu respectively but when there is duplicate entries in the field for each nested field, thats where it gets confused.

How could I revise this regex to grab node_class=n##.## and stop before it gets to a + sign? whenever the data is formatted correctly the delimiter would be the :

Tags (2)
0 Karma
1 Solution

mjones414
Contributor

Success!
rex field=Resource_List_select "(?i):node_class=(?P[^ /+/:]+)"

View solution in original post

mjones414
Contributor

Success!
rex field=Resource_List_select "(?i):node_class=(?P[^ /+/:]+)"

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...