Splunk Search

How do I extract these strings from my sample event as values into their own fields?

Builder
=Application
SourceName=RGFXQA
EventCode=55
EventType=3
Type=Warning
ComputerName=UPS6Z445201Y3.upstreamaccts.XOM.com
TaskCategory=%1
OpCode=Info
RecordNumber=106286
Keywords=Classic
Message=C: has 114.6 GB free of 222.5 GB Total.

I have the above event where type, soucername, keywords, message etc are fields. How can I make the 114.4 GB a field called freespace and 222.5 GB as available space

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Use rex

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Use rex

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Builder

Thank you so much brother.how can I do the freespace percentage like freespace%=(totalspace-freespace)/100.I tried using the eval command but it is not working.Can you please help in this

0 Karma

SplunkTrust
SplunkTrust

This should do it

... | eval pcfree=freespace/totalspace*100 | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Builder

I tried using your command but it is showing all blank

0 Karma

SplunkTrust
SplunkTrust

Does

your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | table freespace totalspace

show any data?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!