I'm collecting a disk space log.
I want to extract fields.
==> Filesystem , Type , Size , Used , Avail , UsePct , MountedOn
I don't know that regular expression & how to make it. Please explain the method.
Filesystem Type Size Used Avail UsePct MountedOn
/dev/mapper/VolGroup00-LogVol00 ext3 88G 11G 73G 13% /
/dev/sda2 ext3 99M 21M 74M 22% /boot
host=splunkH | source=df | sourcetype=df
Hi lanying
basically you can use the docs to setup field extraction. This should give you all the necessary hints to setup field extraction.
as for the regex; I'm not the super-über-hero in regex but to get Type Size Used Avail UsePct you could use \s{1}\w+ as regex.
One think to consider: in larger scale environments, prefer search time field extraction over index time field extraction, because of performance reasons