Additional question 'to the same scenario': "How to use rex to extract Linux directory sizes and names?"
On other servers where I ran the same script, the output differs when retrieving the data through Splunk. All the information seems to be within the same event now.
1000 dir1
1200 dir2
1550 dir3
Etc.
.... | rex "(?\d+)\s+(?\w+)" | eval GB=(size/1024)/1024 | timechart mode(GB) as Size by dir
This will give me only the first line, which is 1000 and dir1. How do I extract the sample above so that I have different events for All
If other words -- if | rex "(?\d+)\s+(?\w+)"
would do the job for this first line -- how to repeat this for all lines within the same event?
Use the max_match option in rex:
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
Example:
| stats count
| fields - count
| eval _raw = "
1000 dir1
1200 dir2
1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
Output:
dir size
-------------------
dir1 1000
dir2 1200
dir3 1550
If you want them all in separate events instead of a multivalued one, you have to use mvexpand:
| stats count
| fields - count
| eval _raw = "
1000 dir1
1200 dir2
1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
| eval size_dir = mvzip(size, dir, "<-->")
| fields - size, dir, _raw
| mvexpand size_dir
| rex field=size_dir "(?<size>\d+)<-->(?<dir>\w+)"
| fields - size_dir
Consider using the multikv
command. It converts tabular event data into separate events for each row of the table.
Use the max_match option in rex:
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
Example:
| stats count
| fields - count
| eval _raw = "
1000 dir1
1200 dir2
1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
Output:
dir size
-------------------
dir1 1000
dir2 1200
dir3 1550
If you want them all in separate events instead of a multivalued one, you have to use mvexpand:
| stats count
| fields - count
| eval _raw = "
1000 dir1
1200 dir2
1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
| eval size_dir = mvzip(size, dir, "<-->")
| fields - size, dir, _raw
| mvexpand size_dir
| rex field=size_dir "(?<size>\d+)<-->(?<dir>\w+)"
| fields - size_dir
This worked for me. Thanks!