Splunk Search

Extract Fields from event

harsush
Path Finder

Hi Team,

Need your help to extract info from below event

HOST=amx0001d ALIVE_STATUS=UP host amx0001d up 12.05 days at time 1498725948 last file update 2 seconds ago /home disk used 31.22 percent last update 42 seconds ago memory+swap used 3.20 percent load 0.05 0.03 0.00 threads 543 procs running 0 procs blocked 0 total CPU used over last minute 0.08 percent (16 cores) total i/o wait over last minute 0.00 percent proc up 1041226 secs, reqs: pri 28096 -mi 0 rej 0, max secs in D state: 0

Output :
amx0001d STATUS = UP
amx0001d up since = 12.05 days
/home disk used percent = 31.22
memory+swap used percent = 3.20
load = 0.05
threads = 543
procs running = 0
procs blocked = 0
total CPU used percent = 0.08
total i/o wait percent = 0.00

Thanks

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regex string will extract the fields you need from the text, assuming the order is constant. You can then put them together into the desired output.

HOST=(?<Host>\w+) ALIVE_STATUS=(?<STATUS>\w+).*? up (?<up_since>[\d\.]+\s\w+).*?(?<disk>\/\w+) disk used (?<disk_percent>[\d\.]+).*?memory\+swap used (?<mem_percent>[\d\.]+) percent load (?<load>[\d\.]+).*? threads (?<threads>\d+) procs running (?<procs>\d+) procs blocked (?<blocked>\d+) total CPU used over last minute (?<CPU_percent>[\d\.]+).*?i\/o wait over last minute (?<io_percent>[\d\.]+)
---
If this reply helps you, Karma would be appreciated.
0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...