How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event?

[pkudrle]

Here is the logged event:

SepsisGraphBuilderImpl: 11252495 MS
  VitalsGraphBuilderImpl: 2257 MS
  Mic2GraphBuilder: 358360 MS
  RasGraphBuilderImpl: 201 MS
  PatientInfoGraphBuilder: 1992 MS
  InterventionEventGraphBuilderImpl: 372 MS
  ObservationInfoGraphBuilder: 42472 MS
  DrugOrderGraphBuilder: 31849 MS

  SurgeryAndRadiologyGraphBuilder: 232 MS

I am wanting to grab each graphbuilder and the time in MS. I thought this search would work, but I am only getting Mic2GraphBuilder:

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder*): (?<totalms>\d+) MS" | table object, totalms

[acharlieh]

Without a Splunk in front of me, I wonder if it's actually be easier to use extract with perhaps untable something like...

host=s*gs* *GraphBuilder* | extract kvdelim=":" | untable _time object totalms

There may be some eval to clean up but it seems like it'd be easier than fighting regular expressions to make multi valued fields.

[pkudrle]

Unfortunately there is some text before and afterwards that interfere

[richgalloway · Accepted solution]

Your regex is looking for words that end with "GraphBuilde" and any number of r's on the end. Try this

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS" | table object, totalms

If you have one graphbuilder/time pair per event then this will work. If you have multiple pairs per event then you will have to add max_match=0 to the rex command and then process the object and totalms fields as multi-valued fields.

[pkudrle]

how do you then parse the multi-valued fields as pairs?

[richgalloway]

You combine the two multi-valued fields and then expand them into separate events. Then you process each event as you normally would. Something like this.

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS"  | eval pairs=mvzip(object,totalms) | mvexpand pairs | ...