Splunk Search

Field Extraction And Evaluation

rhugo
Observer

![alt text][1]

From the screenshot, i would like to achieve the below;

LCU04 = 500 x 00000
LCU03 = 500 x 01985
LCU02 = 500 x 01985
LCU01 = 500 x 01985

Then, LCU = (LCU04 + LCU03 + LCU02 + LCU01)

Please help me achieve this.

Thank you.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="2019-12-04 11:31:42.027 8 ResourceMgr   ATM 11:31:42 LCU Lcu04 500   00 00000   {journal}:::2019-12-04 11:31:42.024 8 ResourceMgr   ATM 11:31:42 LCU Lcu03 500   01 01985   {journal}:::2019-12-04 11:31:42.020 8 ResourceMgr   ATM 11:31:42 LCU Lcu02 500   01 01985   {journal}:::2019-12-04 11:31:42.017 8 ResourceMgr   ATM 11:31:42 LCU Lcu01 500   00 01985   {journal}"
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw
| eval _time = strptime(_raw, "%Y-%m-%d %H:%M:%S.%3N")
| sort 0 - _time

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "LCU\s+(?<LCU_key>\S+)\s+(?<LCU_base>\d+)\s+(?<LCU_stage>\d+)\s+(?<LCU_multiplier>\d+)"
| eval {LCU_key} = LCU_base * LCU_multiplier
| filldown Lcu*
| eval LCU_total = Lcu01 + Lcu02 + Lcu03 + Lcu04
| where isnotnull(LCU_total)
| table LCU_total *

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="2019-12-04 11:31:42.027 8 ResourceMgr   ATM 11:31:42 LCU Lcu04 500   00 00000   {journal}:::2019-12-04 11:31:42.024 8 ResourceMgr   ATM 11:31:42 LCU Lcu03 500   01 01985   {journal}:::2019-12-04 11:31:42.020 8 ResourceMgr   ATM 11:31:42 LCU Lcu02 500   01 01985   {journal}:::2019-12-04 11:31:42.017 8 ResourceMgr   ATM 11:31:42 LCU Lcu01 500   00 01985   {journal}"
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw
| eval _time = strptime(_raw, "%Y-%m-%d %H:%M:%S.%3N")
| sort 0 - _time

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "LCU\s+(?<LCU_key>\S+)\s+(?<LCU_base>\d+)\s+(?<LCU_stage>\d+)\s+(?<LCU_multiplier>\d+)"
| eval {LCU_key} = LCU_base * LCU_multiplier
| filldown Lcu*
| eval LCU_total = Lcu01 + Lcu02 + Lcu03 + Lcu04
| where isnotnull(LCU_total)
| table LCU_total *
0 Karma

woodcock
Esteemed Legend

NEVER post images without also posting the text, otherwise WE have to type it in to help you.

0 Karma

rhugo
Observer

Thank you. This helped.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...