Splunk Search

Need help with a rex extraction

theouhuios
Motivator

Hello

I have a string like this

a SysStatsUtilizationDiskSpace=17.60% /, SysStatsUtilizationDiskSpace=11.25% /storedconfig, SysStatsUtilizationDiskSpace=7.15% /tmp,

I need to extract the value and also the filesystem. I am able to extract for the first one and as you can see the format is repetitive. How do I make this \s+\S+\=(?P<SysStatsUtilizationDiskSpace1>\S+)\%\s+(?P<filesystem1>\S+)\, repetitive so that I dont need to write it again and again.

Any help please

Thanks

Tags (1)
0 Karma

lguinn2
Legend

I think the best way would be to create field extractions in props.conf and transforms.conf

In props.conf

[yoursourcetypehere]
TRANSFORMS-e1=extract_fields_1, extract_fields_2

In transforms.conf

[extract_fields_1]
REGEX = SysStatsUtilizationDiskSpace\s*=\s*\S+%\s*(\S+)
FORMAT = filesystem::$1
MV_ADD = true

# you may already have the field extractions for SysStatsUtilizationDiskSpace, but if not, this will create it
[extract_fields_2]
REGEX = SysStatsUtilizationDiskSpace\s*=\s*(\S+)%
FORMAT = SysStatsUtilizationDiskSpace::$1
MV_ADD = true

This will give you multi-valued fields, rather than fields named filesystem1, filesystem2, etc. It also requires that you do nothing in your search command. To see if it works, run this search

sourcetype=yoursourcetype | table SysStatsUtilizationDiskSpace filesystem
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...