How to split my sample events using regular expression

[prathapkcsc]

Hi,
i have a sample data file like this, all columns are tab separated

TYPE                            Category             Count           CPU Usage (%)
Data Node                       Hadoop                26               0.17
Flume                           Hadoop                9                0.2
ResourceManager                 Hadoop                2                0.06
Hadoop                          ZooKeeper             5                0.19
Foyer                           Hadoop                2                0.28
Splunk                          Hadoop                1                0.06
RabbitMQ                        Non-Hadoop            7                0.98
PostGreSQL                      Non-Hadoop            3                0.11
TC_Server                       Non-Hadoop            12               0.67
Edge                            Hadoop                2                0.19

i want to import this into Splunk and need to split this data.
Finally, i need all the values in table format.
Thank you

[woodcock]

You need multikv like this:

|makeresults
| eval _raw = "TYPE                            Category             Count           CPU Usage (%)
Data Node                       Hadoop                26               0.17
Flume                           Hadoop                9                0.2
ResourceManager                 Hadoop                2                0.06
Hadoop                          ZooKeeper             5                0.19
Foyer                           Hadoop                2                0.28
Splunk                          Hadoop                1                0.06
RabbitMQ                        Non-Hadoop            7                0.98
PostGreSQL                      Non-Hadoop            3                0.11
TC_Server                       Non-Hadoop            12               0.67
Edge                            Hadoop                2                0.19"
| multikv forceheader=1

[prathapkcsc]

I don't want to hard code the values. Dynamically it has to take the event.

[prathapkcsc]

Please can you provide me the solution?
I want to avoid that copying data, How do i make it dynamic

[woodcock]

Don't be silly; the hardcoding wasy to show you that multikv works. Just add this to the bottom of your existing search:

... | mulitkv forceheader=1 | table *

See?

[prathapkcsc]

I didn't understand.
Please explain me clearly.
Thank you

[somesoni2]

Look at this post

https://answers.splunk.com/answers/1048/how-do-index-tab-delimited-files.html

[prathapkcsc]

Can you provide me the regular expression?

[somesoni2]

How does your data looks in Splunk? Does all these lines comes as part of single event OR each line is separate event?

If it's all coming as single event, you run search like this (will treat the event as table, split into rows with first line as header)

your base search | multikv 

If each line is coming as separate event, then you can do like this

your base search | rex "(?<TYPE>.+)\t(?<Category>.+)\t(?<Count>.+)\t(?<CPU_Usage_Perc>.+)"

[prathapkcsc]

No, Above data is a single event.

[prathapkcsc]

Its not working. I changed the files, but no use.

[horsefez]

Hi,

how about that

(?:^\s*?)(?<TYPE>[^\t]+)(?:[\t\s]+)(?<Category>[^\t]+)(?:[\t\s]+)(?<Count>[^\t]+)(?:[\t\s]+)(?<CPU_Usage>[^\t]+)(?:[\t\s]+)?

[prathapkcsc]

base search   |  rex " .*?(?:^\s*?)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)? " | table Type,CPU_Usage 

I am not getting any data.

[horsefez]

this is the wrong usage of the rex-command

... | rex field=_raw "(?:^\s*?)(?<TYPE>[^\t]+)(?:[\t\s]+)(?<Category>[^\t]+)(?:[\t\s]+)(?<Count>[^\t]+)(?:[\t\s]+)(?<CPU_Usage>[^\t]+)(?:[\t\s]+)?" | ...

[prathapkcsc]

 rex field=_raw "(?:^\s*?)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)?" | table TYPE Category 

i tried the above query.
The entire data coming only in single row ( in TYPE).

[aaraneta_splunk]

@prathapkcsc - Just so you know, there is special markup language on this site so certain symbols will transform your post. If you wrap a word in the asterisk symbol * or _, without wrapping it in a code sample, it will italicize the word. If you wish to show the * (i.e. you are displaying sample code or search), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that the * will display.