How to use rex to extract Linux directory sizes and names?

[edwinmae]

I run a daily script on the server, du -sk, against a certain directory that contains 200 subdirectories and write that to a .txt file

Example output (of the .txt file)

1000 name1 (1000 = size (total) and name1 = subdirectory)
1100 name2
1200 name3

---

In Splunk this shows in a similar way as above
Time and Event (Event data is 1000 name1) -- example --

Next line = 1100 name2, etc. --- every line looks like a 'separate' event (=line) in Splunk --

---

Now when I try to Extract new fields it throws:

Error in 'rex' command: Encountered the following error while compiling the regex '(?i)^(?P[^\t]+)': Regex: syntax error in subpattern name (missing terminator) 

---

Target is to show the output in a graph (likely in MB or GB) per 'subdirectory'. I saw a similar case, but I was not able to re-produce the solution that was stated.

There is very likely a very simple solution for this to separate the e.g. 1000 from the name1, but I have not succeeded myself -- Yeah I know 🙂

[edwinmae]

Additional question 'to the same scenario': If we would have the following (within the same event)

1000 dir1
1200 dir2
1550 dir3
Etc.

---

 .... | rex "(?<size>\d+)\s+(?<dir>\w+)" | eval GB=(size/1024)/1024 | timechart mode(GB) as Size by dir

This will give me only the first line, which is 1000 and dir1. How do I extract the sample above so that I have different events for all (directories and total values)?

[richgalloway · Accepted solution]

There's no need for the (?i) flag since your regex does not contain alphas. This command will extract the directory size and name.

... | rex "(?<size>\d+)\s+(?<dir>\w+)" | ...

[edwinmae]

Worked -- Thanks!