Regex multiple fields extraction and graph

[nirt]

Hi All,
I have a website which produces statistics and it is shown like this(over 1K lines, so just pasting a few)
Each line is produced for each server(e.g there are 2/3 servers) which are seperated by
:

<3>
null

<2>
RealDBMisc.aborted.hod.-1.number = 0
RealDBMisc.aborted.hod.-1.total = 0
RealDBMisc.aborted.hod.-1.avarage = 0
UserDBMisc.aborted.hod.-1.number = 0
UserDBMisc.aborted.hod.-1.avarage = 0
UserDBMisc.aborted.hod.-1.total = 0
ipc.Routing.RouteCostRequest.success.hod.-1.total = 15204
ipc.vs-changeVenueProduct.success.hod.-1.number = 82


The statistics are for the past hour, so the collection is also per hour
I'm looking for a regex syntax to help me filter fields and create graphs, for example I want a graph to show me the numbers after UserDBMisc.aborted.hod.-1.avarage for a custom time

Thanks in advance

[ayme]

Something like this?:

sourcetype=yourdata | rex max_match=99999 field=your_field_holding_all_values "(?<yourfield>[^\n]+)"  | mvexpand yourfield | search yourfield="ipc.DDBRemoveCache.alerts.success.hod.-1.total*" | rex field=yourfield "(?P<field>[^\=]+)=(?P<value>.*)" | table field, value

[sandeep_at_func]

I'm a little fuzzy on understanding this one, is that one event? It might help (me and others) to see what three events would like like from this source. I'm sure we can figure it out 🙂

[nirt]

Small correction:
I have a source that gives a lot of statistic information, each line is different content
for example:
pc.DDBRemoveCache.alerts.success.hod.-1.total = 527
ipc.DDBRemoveCache.alerts.success.hod.-1.avarage = 1
ipc.DDBRemoveCache.alerts.success.hod.-1.number = 527
ipc.DDBUpdateCache.alerts.success.hod.-1.number = 161
ipc.DDBUpdateCache.alerts.success.hod.-1.total = 161
ipc.DDBUpdateCache.alerts.success.hod.-1.avarage = 1

so it's quite simple: name = value
but I can't seem to get the regex properly working

[nirt]

One event gives out over 1000 lines of data, each line is a statistic event, however those events can be in multiple servers(divided by the such as <2>)
I need somehow to tell Splunk to know those fields so I can create graphs on each field as I wish

Thanks