Solaris df log - fields extraction

[lanying]

I'm collecting a disk space log.
I want to extract fields.
==> Filesystem , Type , Size , Used , Avail , UsePct , MountedOn

I don't know that regular expression & how to make it. Please explain the method.

---

Filesystem Type Size Used Avail UsePct MountedOn

/dev/mapper/VolGroup00-LogVol00 ext3 88G 11G 73G 13% /

/dev/sda2 ext3 99M 21M 74M 22% /boot
host=splunkH | source=df | sourcetype=df

[MuS]

Hi lanying

basically you can use the docs to setup field extraction. This should give you all the necessary hints to setup field extraction.

as for the regex; I'm not the super-über-hero in regex but to get Type Size Used Avail UsePct you could use \s{1}\w+ as regex.

One think to consider: in larger scale environments, prefer search time field extraction over index time field extraction, because of performance reasons