Splunk Search

How do I extract these strings from my sample event as values into their own fields?

vrmandadi
Builder
=Application
SourceName=RGFXQA
EventCode=55
EventType=3
Type=Warning
ComputerName=UPS6Z445201Y3.upstreamaccts.XOM.com
TaskCategory=%1
OpCode=Info
RecordNumber=106286
Keywords=Classic
Message=C: has 114.6 GB free of 222.5 GB Total.

I have the above event where type, soucername, keywords, message etc are fields. How can I make the 114.4 GB a field called freespace and 222.5 GB as available space

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use rex

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use rex

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...
---
If this reply helps you, Karma would be appreciated.

vrmandadi
Builder

Thank you so much brother.how can I do the freespace percentage like freespace%=(totalspace-freespace)/100.I tried using the eval command but it is not working.Can you please help in this

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should do it

... | eval pcfree=freespace/totalspace*100 | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

I tried using your command but it is showing all blank

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | table freespace totalspace

show any data?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...