Splunk Search

How do I edit my regular expression for rex to extract all expected fields and values from my sample multiline event?

New Member

Here is the logged event:

SepsisGraphBuilderImpl: 11252495 MS
  VitalsGraphBuilderImpl: 2257 MS
  Mic2GraphBuilder: 358360 MS
  RasGraphBuilderImpl: 201 MS
  PatientInfoGraphBuilder: 1992 MS
  InterventionEventGraphBuilderImpl: 372 MS
  ObservationInfoGraphBuilder: 42472 MS
  DrugOrderGraphBuilder: 31849 MS

  SurgeryAndRadiologyGraphBuilder: 232 MS

I am wanting to grab each graphbuilder and the time in MS. I thought this search would work, but I am only getting Mic2GraphBuilder:

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder*): (?<totalms>\d+) MS" | table object, totalms
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Your regex is looking for words that end with "GraphBuilde" and any number of r's on the end. Try this

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS" | table object, totalms

If you have one graphbuilder/time pair per event then this will work. If you have multiple pairs per event then you will have to add max_match=0 to the rex command and then process the object and totalms fields as multi-valued fields.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Influencer

Without a Splunk in front of me, I wonder if it's actually be easier to use extract with perhaps untable something like...

host=s*gs* *GraphBuilder* | extract kvdelim=":" | untable _time object totalms

There may be some eval to clean up but it seems like it'd be easier than fighting regular expressions to make multi valued fields.

New Member

Unfortunately there is some text before and afterwards that interfere

0 Karma

SplunkTrust
SplunkTrust

Your regex is looking for words that end with "GraphBuilde" and any number of r's on the end. Try this

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS" | table object, totalms

If you have one graphbuilder/time pair per event then this will work. If you have multiple pairs per event then you will have to add max_match=0 to the rex command and then process the object and totalms fields as multi-valued fields.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

New Member

how do you then parse the multi-valued fields as pairs?

0 Karma

SplunkTrust
SplunkTrust

You combine the two multi-valued fields and then expand them into separate events. Then you process each event as you normally would. Something like this.

host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS"  | eval pairs=mvzip(object,totalms) | mvexpand pairs | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma