Splunk Search

Solaris df log - fields extraction


I'm collecting a disk space log.
I want to extract fields.
==> Filesystem , Type , Size , Used , Avail , UsePct , MountedOn

I don't know that regular expression & how to make it. Please explain the method.

Filesystem Type Size Used Avail UsePct MountedOn

/dev/mapper/VolGroup00-LogVol00 ext3 88G 11G 73G 13% /

/dev/sda2 ext3 99M 21M 74M 22% /boot
host=splunkH | source=df | sourcetype=df

Tags (1)
0 Karma


Hi lanying

basically you can use the docs to setup field extraction. This should give you all the necessary hints to setup field extraction.

as for the regex; I'm not the super-über-hero in regex but to get Type Size Used Avail UsePct you could use \s{1}\w+ as regex.

One think to consider: in larger scale environments, prefer search time field extraction over index time field extraction, because of performance reasons

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!