Hello folks,
I've this event from custom data source:
01/07/2019 16:27:08
type=cpu_util
SNMP table: HOST-RESOURCES-MIB::hrProcessorTable
hrProcessorFrwID hrProcessorLoad
SNMPv2-SMI::zeroDotZero 20
SNMPv2-SMI::zeroDotZero 17
SNMPv2-SMI::zeroDotZero 19
SNMPv2-SMI::zeroDotZero 23
SNMPv2-SMI::zeroDotZero 10
SNMPv2-SMI::zeroDotZero 22
SNMPv2-SMI::zeroDotZero 8
SNMPv2-SMI::zeroDotZero 4
SNMPv2-SMI::zeroDotZero 7
SNMPv2-SMI::zeroDotZero 3
SNMPv2-SMI::zeroDotZero 4
SNMPv2-SMI::zeroDotZero 6
SNMPv2-SMI::zeroDotZero 33
SNMPv2-SMI::zeroDotZero 14
SNMPv2-SMI::zeroDotZero 13
SNMPv2-SMI::zeroDotZero 8
this is a one event that represents the utilization for the cpu cores. how to extract the numbers in each row ? I tried but it extract the first number only (20) . how to write regex to extract all numbers.
Use a REPORT extraction and add MV_ADD = true
in your transforms.conf. For example:
props.conf
[mysourcetype]
REPORT-cpu_util = my_cpu_util
transforms.conf
[my_cpu_util]
REGEX = SNMPv2-SMI::zeroDotZero\s+(?<cpu_util>\d+)
MV_ADD = true
This should result in a multi valued field called cpu_util.