Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Regex for SAR data in UNIX

theouhuios
Motivator
‎11-20-2012 10:57 AM

Hello

I need to create a timechart for the data below based on cpu's available and the utilization of that specific cpu. I have a field for pctSystem so that hasn't been an issue. But I don't have a CPU field which I can use in the timechart. Can anyone please tell me what regex needs to be used to obtain vertical data for CPU

CPU pctUser pctNice pctSystem pctIowait pctIdle
0 51 ? 21 0 28
1 55 ? 19 0 25
all 53 ? 20 0 26

Tags (1)
0 Karma
Reply

sdaniels
Splunk Employee
Splunk Employee
‎11-20-2012 10:59 AM

Here's a great reference for you with the multikv command:

http://blogs.splunk.com/2007/08/23/ripping-mulitline-events-at-seach-time/

Previous answer:

http://splunk-base.splunk.com/answers/7352/multikv-field-extraction

0 Karma
Reply
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...