Splunk Search

To Rex or not to rex?

Explorer

Hi All,

Hope your having a great Day.. I have a dilemma !

I have the following log extract where i want to timeline values to show instance counts.

Nov01 23:23:35.750EDT 18814 INFO New Counts: {'instance1': 75, 'instance2': 238, 'instance3': 274, 'instance4': 245, 'instance5': 220, 'instance6': 199, 'instance7': 276, 'instance8': 214, 'instance9': 233, 'Partial1': 3, 'Partial2': 64, 'Partial3': 61, 'instance10': 216, 'instance11': 224, 'instance12': 0, 'component1': 90, 'instance13': 55, 'instance14': 24, 'component2': 2}

Also, to make matters a little tricky, the above sometimes comes in a different order (the instance/partial/component names never change and their values go from 0 - 400 only).

I tried using the Splunk regex tool, but the last few numbers generated huge rex's (due to the positions i guess). One good thing is the name of the instance, the comma, and the numbers are always in the same alignment.

Can anyone help ? Thanks community!

George

0 Karma
1 Solution

Splunk Employee
Splunk Employee

You could use the KEY1 and VAL1 capture group names. Take a look at the example below.

Using this method allows you to dynamically capture all of the key value pairs regardless of order and quantity in an event, without having to write some large regexes. You can put this in your props.conf under the appropriate sourcetype.

props.conf:
EXTRACT-bracks2 = \'(?<_KEY_1>[a-z0-9]+)\'\: (?<_VAL_1>[0-9]+)

View solution in original post

Splunk Employee
Splunk Employee

hi @luckyman80

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

Splunk Employee
Splunk Employee

You could use the KEY1 and VAL1 capture group names. Take a look at the example below.

Using this method allows you to dynamically capture all of the key value pairs regardless of order and quantity in an event, without having to write some large regexes. You can put this in your props.conf under the appropriate sourcetype.

props.conf:
EXTRACT-bracks2 = \'(?<_KEY_1>[a-z0-9]+)\'\: (?<_VAL_1>[0-9]+)

View solution in original post

Explorer

Thanks this worked a treat

0 Karma