Splunk Search

How to generate a search that will extract data from fields contained in a certain column?

hceylan97
New Member

I need to create a time series chart based on last_run and Total CPU Yields output from Sybase sysmon output file. I am currently indexing sysmon files the they look something like this:

last_run                        current_run                     seconds     
 ------------------------------- ------------------------------- ----------- 
             Jan 12 2017  1:43PM             Jan 12 2017  1:46PM         139 

Total CPU Yields                 2021.8          13.6      606554  

I need to come up with a search pattern to extract last_run and Total CPU Yields to chart. In this case, last_run is Jan 12 2017 1:43PM and Total CPU Yields is 13.6

how I can do this?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@hceylan97 - Were you able to test out woodcock's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

woodcock
Esteemed Legend

On ad ad-hoc basis, you can use rex like this:

 | rex field=raw "(?ms)(?<last_run>\w+\s+\d+\s+\d+\s+\d+:\d+\S+)\s+(?<current_run>\w+\s+\d+\s+\d+\s+\d+:\d+\S+)\s+(?<seconds>\d+).*Total\s+CPU\s+Yields\s+(?<last_yield>\S+)\s+(?<current_yield>\S+)\s+(?<seconds_yield>\S+)"
0 Karma

niketn
Legend

Have you tried to search your indexed data in verbose mode? How does each event look like? Are fields like CPU Yeilds extracted as interesting fields and belong to the same event with last_run and current_run time stamps?

If the fields are not already extracted you might have to extract them first (simplest way would be through rex), provided entire raw data belongs to the same event.

So if you can please share samples of raw events indexed.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...