Splunk Search

Require help with rex query

Mrig342
Contributor

Hi,

I have the below type of logs:

log1: Mon Feb 8 02:57:36 EST 2021 41% /logs

log2: Mon Feb 8 02:57:36 EST 2021 73% /opt

log3: Mon Feb 8 02:57:36 EST 2021 69% /var

log4: Mon Feb 8 02:57:36 EST 2021 48% /apps

I want to create a table as below:

File_System           Disk_Usage

\logs                             41

\opt                              73

\var                               69

\apps                           48

Here I want to extract the "Disk_Usage" and "File_System" fields with the respective values. This might be a very silly question but I might be missing out something while creating the rex command. So please help me create the rex command. you kind support will be highly appreciated.

 

Thank you.

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @Mrig342,

Try this,

| makeresults 
| eval _raw=" _raw
Mon Feb 8 02:57:36 EST 2021 41% /logs
Mon Feb 8 02:57:36 EST 2021 73% /opt
Mon Feb 8 02:57:36 EST 2021 69% /var
Mon Feb 8 02:57:36 EST 2021 48% /apps" 
| multikv forceheader=1 
| rex "\s(?<Disk_Usage>\d+)\%\s\/(?<File_System>\w+)" 
| table File_System, Disk_Usage

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

manjunathmeti
Champion

hi @Mrig342,

Try this,

| makeresults 
| eval _raw=" _raw
Mon Feb 8 02:57:36 EST 2021 41% /logs
Mon Feb 8 02:57:36 EST 2021 73% /opt
Mon Feb 8 02:57:36 EST 2021 69% /var
Mon Feb 8 02:57:36 EST 2021 48% /apps" 
| multikv forceheader=1 
| rex "\s(?<Disk_Usage>\d+)\%\s\/(?<File_System>\w+)" 
| table File_System, Disk_Usage

 

If this reply helps you, an upvote/like would be appreciated.

Mrig342
Contributor

Thank you very much @manjunathmeti.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...