Splunk Search

How to split my sample events using regular expression

Explorer

Hi,
i have a sample data file like this, all columns are tab separated

TYPE                            Category             Count           CPU Usage (%)
Data Node                       Hadoop                26               0.17
Flume                           Hadoop                9                0.2
ResourceManager                 Hadoop                2                0.06
Hadoop                          ZooKeeper             5                0.19
Foyer                           Hadoop                2                0.28
Splunk                          Hadoop                1                0.06
RabbitMQ                        Non-Hadoop            7                0.98
PostGreSQL                      Non-Hadoop            3                0.11
TC_Server                       Non-Hadoop            12               0.67
Edge                            Hadoop                2                0.19

i want to import this into Splunk and need to split this data.
Finally, i need all the values in table format.
Thank you

0 Karma

Esteemed Legend

You need multikv like this:

|makeresults
| eval _raw = "TYPE                            Category             Count           CPU Usage (%)
Data Node                       Hadoop                26               0.17
Flume                           Hadoop                9                0.2
ResourceManager                 Hadoop                2                0.06
Hadoop                          ZooKeeper             5                0.19
Foyer                           Hadoop                2                0.28
Splunk                          Hadoop                1                0.06
RabbitMQ                        Non-Hadoop            7                0.98
PostGreSQL                      Non-Hadoop            3                0.11
TC_Server                       Non-Hadoop            12               0.67
Edge                            Hadoop                2                0.19"
| multikv forceheader=1
0 Karma

Explorer

I don't want to hard code the values. Dynamically it has to take the event.

0 Karma

Explorer

Please can you provide me the solution?
I want to avoid that copying data, How do i make it dynamic

0 Karma

Esteemed Legend

Don't be silly; the hardcoding wasy to show you that multikv works. Just add this to the bottom of your existing search:

... | mulitkv forceheader=1 | table *

See?

0 Karma

Explorer

I didn't understand.
Please explain me clearly.
Thank you

0 Karma

SplunkTrust
SplunkTrust

Explorer

Can you provide me the regular expression?

0 Karma

SplunkTrust
SplunkTrust

How does your data looks in Splunk? Does all these lines comes as part of single event OR each line is separate event?

If it's all coming as single event, you run search like this (will treat the event as table, split into rows with first line as header)

your base search | multikv 

If each line is coming as separate event, then you can do like this

your base search | rex "(?<TYPE>.+)\t(?<Category>.+)\t(?<Count>.+)\t(?<CPU_Usage_Perc>.+)"
0 Karma

Explorer

No, Above data is a single event.

0 Karma

Explorer

Its not working. I changed the files, but no use.

0 Karma

SplunkTrust
SplunkTrust

Hi,

how about that

(?:^\s*?)(?<TYPE>[^\t]+)(?:[\t\s]+)(?<Category>[^\t]+)(?:[\t\s]+)(?<Count>[^\t]+)(?:[\t\s]+)(?<CPU_Usage>[^\t]+)(?:[\t\s]+)?
0 Karma

Explorer
base search   |  rex " .*?(?:^\s*?)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)? " | table Type,CPU_Usage 

I am not getting any data.

0 Karma

SplunkTrust
SplunkTrust

this is the wrong usage of the rex-command

... | rex field=_raw "(?:^\s*?)(?<TYPE>[^\t]+)(?:[\t\s]+)(?<Category>[^\t]+)(?:[\t\s]+)(?<Count>[^\t]+)(?:[\t\s]+)(?<CPU_Usage>[^\t]+)(?:[\t\s]+)?" | ...
0 Karma

Explorer
 rex field=_raw "(?:^\s*?)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)?" | table TYPE Category 

i tried the above query.
The entire data coming only in single row ( in TYPE).

0 Karma

Splunk Employee
Splunk Employee

@prathapkcsc - Just so you know, there is special markup language on this site so certain symbols will transform your post. If you wrap a word in the asterisk symbol * or _, without wrapping it in a code sample, it will italicize the word. If you wish to show the * (i.e. you are displaying sample code or search), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that the * will display.

0 Karma