Splunk Search

Unable to do timechart for a field which has varying values

anoopambli
Communicator

I am extracting a field using regular expression, it looks like below, These are top 5 processes which is consuming high memory

SiteScope.exe MemGB : 4886
perfmon.exe MemGB : 282
svchost.exe MemGB : 172
powershell.exe MemGB : 125
WmiApSrv.exe MemGB : 107
SiteScope.exe MemGB : 4885
perfmon.exe MemGB : 282
svchost.exe MemGB : 172
powershell.exe MemGB : 125
WmiApSrv.exe MemGB : 107
SiteScope.exe MemGB : 4884
perfmon.exe MemGB : 282
svchost.exe MemGB : 172
powershell.exe MemGB : 125

I am splitting the process name and memory usage again using regex. Once i do that there is be 5 process names but many numbers of memory usage values (during the selected time frame). I want to do a timechart for memory usage but it is not coming up correctly. When i do a table for Processname and memory, each event is coming up with 5 proc names and mem usage. How do i split them into separate events?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

You would need mvexpand command to split a multivalued field. Give this a try

index = tso_operations sourcetype = sitescope_monitorstate host = tsmonw24prdv "[TSMONW46PRDV] Top 10 Proc_Mem" | rex max_match=5 "Name\s+:\s+(?<Process>\S+\sMemGB\s:\s\d+)" | mvexpand Process | rex field=Process "^(?<Process>\w+).exe\sMemGB\s:\s(?<MemGB>\d+)" | timechart max(MemGB) by Process limit=0 

View solution in original post

sloshburch
Ultra Champion

Isn't this info also available from the top input in the Nix TA? I thought both Win and Nix TAs had nice definitions of data collections and sourcetypes for this type of info.

0 Karma

somesoni2
Revered Legend

You would need mvexpand command to split a multivalued field. Give this a try

index = tso_operations sourcetype = sitescope_monitorstate host = tsmonw24prdv "[TSMONW46PRDV] Top 10 Proc_Mem" | rex max_match=5 "Name\s+:\s+(?<Process>\S+\sMemGB\s:\s\d+)" | mvexpand Process | rex field=Process "^(?<Process>\w+).exe\sMemGB\s:\s(?<MemGB>\d+)" | timechart max(MemGB) by Process limit=0 

View solution in original post

anoopambli
Communicator

That worked. Thank you very much.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is the sample data a single event or multiple events?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

sundareshr
Legend

Please share your query (including the regex)

0 Karma

anoopambli
Communicator

index = tso_operations sourcetype = sitescope_monitorstate host = tsmonw24prdv "[TSMONW46PRDV] Top 10 Proc_Mem" | rex max_match=5 "Name\s+:\s+(?\S+\sMemGB\s:\s\d+)" | rex field=Process "(?^\w+).exe\sMemGB\s:\s(?\d+)"

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.