Splunk Search

Solaris df log - fields extraction

lanying
Explorer

I'm collecting a disk space log.
I want to extract fields.
==> Filesystem , Type , Size , Used , Avail , UsePct , MountedOn

I don't know that regular expression & how to make it. Please explain the method.


Filesystem Type Size Used Avail UsePct MountedOn

/dev/mapper/VolGroup00-LogVol00 ext3 88G 11G 73G 13% /

/dev/sda2 ext3 99M 21M 74M 22% /boot
host=splunkH | source=df | sourcetype=df

Tags (1)
0 Karma

MuS
Legend

Hi lanying

basically you can use the docs to setup field extraction. This should give you all the necessary hints to setup field extraction.

as for the regex; I'm not the super-über-hero in regex but to get Type Size Used Avail UsePct you could use \s{1}\w+ as regex.

One think to consider: in larger scale environments, prefer search time field extraction over index time field extraction, because of performance reasons

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...