How do I get only certain value from a log in results ?

[kkrish0602]

Is it possible to get a particular value from search results in my final output. I'm having a hard time getting them the way I want them to display in a table.

Search="mpmstats"

Here is the output of my search.

Out of this I need only bsy value to be displayed in a table as my output like below format

Still learning 🙂..

Pleas help.... Thanks in Advance

[renjith_nair]

If bsy is not a field, try extracting the field and use it in your search.

E.g.

|rex field=_raw "bsy:\s+(?<bsy>\d+)"|timechart avg(bsy)

Test

|makeresults|eval text="mpstats: bsy:  400"
|rex field=text "bsy:\s+(?<Busy>\d+)"

[kkrish0602]

<mysearch> | rex field=_raw "bsy:\s+(?<bsy>\d+)"|timechart avg(bsy) is not giving any output

I want my output like

time	host1	host2
1	bsy value	bsy value
2	bsy value	bsy value

[yuanliu]

---

---

@kkrish0602 wrote:

<mysearch> | rex field=_raw "bsy:\s+(?<bsy>\d+)"|timechart avg(bsy) is not giving any output

I want my output like

time	host1	host2
1	bsy value	bsy value
2	bsy value	bsy value

---

When giving sample data, desired output, or search code, it is best to use text. Screenshots can be too noisy to be read accurately and difficult to translate into code samples.  According to the screenshot, the above has to output something even if it is not what you were asking.

If the desired output you described is truly in a timechart, you have to also define what stats function to use to obtain "bsy value": is it avg(bsy)? is it max(bsy)? is it values(bsy)? etc. (See Timechart.)  It is possible that you also want to include those events in which the string "bsy" and the value is not separated by colon (:).  In that case, you could use

| rex "bsy:*\s+(?<bsy>\d+)"
| timechart avg(bsy) by host

If the "bsy value" in your desired output is not a statistic but the individual value in each event, the command you are looking for is perhaps xyseries instead of timechart, e.g.,

| rex "bsy:*\s+(?<bsy>\d+)"
| xyseries _time host bsy

[renjith_nair]

Could you please post some sample events ?

Here is the link to test

https://regex101.com/r/32TXGO/1

[isoutamo]

You also should add those "| search x y z" directly to the first part of your query without "| search". It's much efficient to reduce the search result set on first phase than add those later on search pipeline.