Extract Fields from event

[harsush]

Hi Team,

Need your help to extract info from below event

HOST=amx0001d ALIVE_STATUS=UP host amx0001d up 12.05 days at time 1498725948 last file update 2 seconds ago /home disk used 31.22 percent last update 42 seconds ago memory+swap used 3.20 percent load 0.05 0.03 0.00 threads 543 procs running 0 procs blocked 0 total CPU used over last minute 0.08 percent (16 cores) total i/o wait over last minute 0.00 percent proc up 1041226 secs, reqs: pri 28096 -mi 0 rej 0, max secs in D state: 0

Output :
amx0001d STATUS = UP
amx0001d up since = 12.05 days
/home disk used percent = 31.22
memory+swap used percent = 3.20
load = 0.05
threads = 543
procs running = 0
procs blocked = 0
total CPU used percent = 0.08
total i/o wait percent = 0.00

Thanks

[richgalloway]

This regex string will extract the fields you need from the text, assuming the order is constant. You can then put them together into the desired output.

HOST=(?<Host>\w+) ALIVE_STATUS=(?<STATUS>\w+).*? up (?<up_since>[\d\.]+\s\w+).*?(?<disk>\/\w+) disk used (?<disk_percent>[\d\.]+).*?memory\+swap used (?<mem_percent>[\d\.]+) percent load (?<load>[\d\.]+).*? threads (?<threads>\d+) procs running (?<procs>\d+) procs blocked (?<blocked>\d+) total CPU used over last minute (?<CPU_percent>[\d\.]+).*?i\/o wait over last minute (?<io_percent>[\d\.]+)

[adonio]

use the gui field extractor
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/ExtractfieldsinteractivelywithIFX
hope it helps