How to generate a search that will extract data from fields contained in a certain column?

[hceylan97]

I need to create a time series chart based on last_run and Total CPU Yields output from Sybase sysmon output file. I am currently indexing sysmon files the they look something like this:

last_run                        current_run                     seconds     
 ------------------------------- ------------------------------- ----------- 
             Jan 12 2017  1:43PM             Jan 12 2017  1:46PM         139 

Total CPU Yields                 2021.8          13.6      606554  

I need to come up with a search pattern to extract last_run and Total CPU Yields to chart. In this case, last_run is Jan 12 2017 1:43PM and Total CPU Yields is 13.6

how I can do this?

[aaraneta_splunk]

@hceylan97 - Were you able to test out woodcock's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

[woodcock]

On ad ad-hoc basis, you can use rex like this:

 | rex field=raw "(?ms)(?<last_run>\w+\s+\d+\s+\d+\s+\d+:\d+\S+)\s+(?<current_run>\w+\s+\d+\s+\d+\s+\d+:\d+\S+)\s+(?<seconds>\d+).*Total\s+CPU\s+Yields\s+(?<last_yield>\S+)\s+(?<current_yield>\S+)\s+(?<seconds_yield>\S+)"

[niketn]

Have you tried to search your indexed data in verbose mode? How does each event look like? Are fields like CPU Yeilds extracted as interesting fields and belong to the same event with last_run and current_run time stamps?

If the fields are not already extracted you might have to extract them first (simplest way would be through rex), provided entire raw data belongs to the same event.

So if you can please share samples of raw events indexed.