Splunk Search

How do I extract these strings from my sample event as values into their own fields?

vrmandadi
Builder
=Application
SourceName=RGFXQA
EventCode=55
EventType=3
Type=Warning
ComputerName=UPS6Z445201Y3.upstreamaccts.XOM.com
TaskCategory=%1
OpCode=Info
RecordNumber=106286
Keywords=Classic
Message=C: has 114.6 GB free of 222.5 GB Total.

I have the above event where type, soucername, keywords, message etc are fields. How can I make the 114.4 GB a field called freespace and 222.5 GB as available space

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use rex

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use rex

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...
---
If this reply helps you, Karma would be appreciated.

vrmandadi
Builder

Thank you so much brother.how can I do the freespace percentage like freespace%=(totalspace-freespace)/100.I tried using the eval command but it is not working.Can you please help in this

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should do it

... | eval pcfree=freespace/totalspace*100 | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

I tried using your command but it is showing all blank

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | table freespace totalspace

show any data?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...