Splunk Search

How to create rex for multiple fields?

Veeru
Path Finder

Hello
Good Day!
I have the events in the raw data where i want to extract the drive information  into few field and convert into gb 

event1:C:\Windows\system FreeSpace DeviceID FreeSpace
C: 36247773184

😧 96900616192

E: 26285309952

event2:C:\Windows\system DeviceID FreeSpace
C: 36247773184

😧 96900616192

event3:C:\Windows\system DeviceID FreeSpace
C: 36247773184

event4:C: 36247773184

😧 96900616192

E: 26285309952

My Query:
index=A
|rex "(?<Drive>\S+:\s+\d+)"
|stats values(Drive) by host _raw

My output:

Host _raw Drive
A1

C:\Windows\system FreeSpace DeviceID FreeSpace
C: 36247773184

😧 96900616192

E: 26285309952

C: 36247773184
A2

C:\Windows\system FreeSpace DeviceID FreeSpace
C: 36247773184

😧 96900616192

 

C: 36247773184


I am getting only first values .But i want to get a the values from the raw event and want to convert the digital value into gb
Please help me on that

Thank you
Veeru

"Happy Splunking"

 

 

Labels (4)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
|rex max_match=0 "(?<Drive>\S+):\s+(?<size>\d+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
|rex max_match=0 "(?<Drive>\S+):\s+(?<size>\d+)"

PickleRick
SplunkTrust
SplunkTrust

You can match multiple times with max_match option for the rex command.

| rex max_match=0 "(?<Drive>..."

Roy_9
Motivator

Hello @Veeru 

Can you try as following:
| eval GB=round(b/1024/1024/1024, 3)

 

 

Thanks

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...