To Rex or not to rex?

[luckyman80]

Hi All,

Hope your having a great Day.. I have a dilemma !

I have the following log extract where i want to timeline values to show instance counts.

Nov01 23:23:35.750EDT 18814 INFO New Counts: {'instance1': 75, 'instance2': 238, 'instance3': 274, 'instance4': 245, 'instance5': 220, 'instance6': 199, 'instance7': 276, 'instance8': 214, 'instance9': 233, 'Partial1': 3, 'Partial2': 64, 'Partial3': 61, 'instance10': 216, 'instance11': 224, 'instance12': 0, 'component1': 90, 'instance13': 55, 'instance14': 24, 'component2': 2}

Also, to make matters a little tricky, the above sometimes comes in a different order (the instance/partial/component names never change and their values go from 0 - 400 only).

I tried using the Splunk regex tool, but the last few numbers generated huge rex's (due to the positions i guess). One good thing is the name of the instance, the comma, and the numbers are always in the same alignment.

Can anyone help ? Thanks community!

George

[mstjohn_splunk]

hi @luckyman80

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[kmorris_splunk · Accepted solution]

You could use the _KEY_1 and _VAL_1 capture group names. Take a look at the example below.

Using this method allows you to dynamically capture all of the key value pairs regardless of order and quantity in an event, without having to write some large regexes. You can put this in your props.conf under the appropriate sourcetype.

props.conf:
EXTRACT-bracks2 = \'(?<_KEY_1>[a-z0-9]+)\'\: (?<_VAL_1>[0-9]+)

[luckyman80]

Thanks this worked a treat