Splunk Search

Solaris df log - fields extraction

lanying
Explorer

I'm collecting a disk space log.
I want to extract fields.
==> Filesystem , Type , Size , Used , Avail , UsePct , MountedOn

I don't know that regular expression & how to make it. Please explain the method.


Filesystem Type Size Used Avail UsePct MountedOn

/dev/mapper/VolGroup00-LogVol00 ext3 88G 11G 73G 13% /

/dev/sda2 ext3 99M 21M 74M 22% /boot
host=splunkH | source=df | sourcetype=df

Tags (1)
0 Karma

MuS
Legend

Hi lanying

basically you can use the docs to setup field extraction. This should give you all the necessary hints to setup field extraction.

as for the regex; I'm not the super-über-hero in regex but to get Type Size Used Avail UsePct you could use \s{1}\w+ as regex.

One think to consider: in larger scale environments, prefer search time field extraction over index time field extraction, because of performance reasons

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...