Splunk Search

Field extraction of multi-line event with header

Path Finder

I have a script for Linux that executes "sar -n DEV" and formats the output to look like:

Linux <kernel version> (<hostname>)  <date>   <arch>   (<#> CPU)
Average:        <interface>   <field1>   <field2>   <field3>
Average:        <interface>   <field1>   <field2>   <field3>
Average:        <interface>   <field1>   <field2>   <field3>

Using Splunk Web's field extractor, I have a regex that applies field extraction to the first "Average:" line. How do I make it so the field is applied to as many "Average:" lines exist?

0 Karma
1 Solution

Ultra Champion
| makeresults
| eval _raw="
 Linux <kernel version> (<hostname>)  <date>   <arch>   (<#> CPU)
 Average:        <interface>   <field1>   <field2>   <field3>
 Average:        <interface>   <field1>   <field2>   <field3>
 Average:        <interface>   <field1>   <field2>   <field3>"
| rex max_match=0 "(?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)"

try REGEX option (?ms) and max_match

transforms.conf

[your stanza]
REGEX  = (?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)
MV_ADD = true

I haven't try this. how about this?

View solution in original post

0 Karma

Ultra Champion
| makeresults
| eval _raw="
 Linux <kernel version> (<hostname>)  <date>   <arch>   (<#> CPU)
 Average:        <interface>   <field1>   <field2>   <field3>
 Average:        <interface>   <field1>   <field2>   <field3>
 Average:        <interface>   <field1>   <field2>   <field3>"
| rex max_match=0 "(?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)"

try REGEX option (?ms) and max_match

transforms.conf

[your stanza]
REGEX  = (?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)
MV_ADD = true

I haven't try this. how about this?

View solution in original post

0 Karma

Path Finder

Would I have to make one REPORT entry per field or can I combine them all into one if I try to do this as a search-time extraction? I saw a key in transforms.conf that could apply for what I'm trying to do (MV_ADD).

0 Karma

Ultra Champion

yes, REGEX and MV_ADD is. my answer is updated.

0 Karma