Splunk Search

How to generate a search that will extract data from fields contained in a certain column?

New Member

I need to create a time series chart based on last_run and Total CPU Yields output from Sybase sysmon output file. I am currently indexing sysmon files the they look something like this:

last_run                        current_run                     seconds     
 ------------------------------- ------------------------------- ----------- 
             Jan 12 2017  1:43PM             Jan 12 2017  1:46PM         139 

Total CPU Yields                 2021.8          13.6      606554  

I need to come up with a search pattern to extract lastrun and Total CPU Yields to chart. In this case, lastrun is Jan 12 2017 1:43PM and Total CPU Yields is 13.6

how I can do this?

0 Karma

Splunk Employee
Splunk Employee

@hceylan97 - Were you able to test out woodcock's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

Esteemed Legend

On ad ad-hoc basis, you can use rex like this:

 | rex field=raw "(?ms)(?<last_run>\w+\s+\d+\s+\d+\s+\d+:\d+\S+)\s+(?<current_run>\w+\s+\d+\s+\d+\s+\d+:\d+\S+)\s+(?<seconds>\d+).*Total\s+CPU\s+Yields\s+(?<last_yield>\S+)\s+(?<current_yield>\S+)\s+(?<seconds_yield>\S+)"
0 Karma


Have you tried to search your indexed data in verbose mode? How does each event look like? Are fields like CPU Yeilds extracted as interesting fields and belong to the same event with lastrun and currentrun time stamps?

If the fields are not already extracted you might have to extract them first (simplest way would be through rex), provided entire raw data belongs to the same event.

So if you can please share samples of raw events indexed.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma