How to use rex to extract Linux directory sizes and names (Part II)?

[edwinmae]

Additional question 'to the same scenario': "How to use rex to extract Linux directory sizes and names?"

On other servers where I ran the same script, the output differs when retrieving the data through Splunk. All the information seems to be within the same event now.

1000 dir1
1200 dir2
1550 dir3
Etc.

  .... | rex "(?\d+)\s+(?\w+)" | eval GB=(size/1024)/1024 | timechart mode(GB) as Size by dir

This will give me only the first line, which is 1000 and dir1. How do I extract the sample above so that I have different events for All

If other words -- if | rex "(?\d+)\s+(?\w+)" would do the job for this first line -- how to repeat this for all lines within the same event?

[richgalloway]

Consider using the multikv command. It converts tabular event data into separate events for each row of the table.

[javiergn · Accepted solution]

Use the max_match option in rex:

| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"

Example:

| stats count
| fields - count
| eval _raw = "
   1000 dir1
   1200 dir2
   1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"

Output:

dir     size
-------------------
dir1    1000
dir2    1200
dir3    1550

If you want them all in separate events instead of a multivalued one, you have to use mvexpand:

| stats count
| fields - count
| eval _raw = "
   1000 dir1
   1200 dir2
   1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
| eval size_dir = mvzip(size, dir, "<-->")
| fields - size, dir, _raw
| mvexpand size_dir
| rex field=size_dir "(?<size>\d+)<-->(?<dir>\w+)"
| fields - size_dir

[edwinmae]

This worked for me. Thanks!