Splunk Search

Unable to do timechart for a field which has varying values

Communicator

I am extracting a field using regular expression, it looks like below, These are top 5 processes which is consuming high memory

SiteScope.exe MemGB : 4886
perfmon.exe MemGB : 282
svchost.exe MemGB : 172
powershell.exe MemGB : 125
WmiApSrv.exe MemGB : 107
SiteScope.exe MemGB : 4885
perfmon.exe MemGB : 282
svchost.exe MemGB : 172
powershell.exe MemGB : 125
WmiApSrv.exe MemGB : 107
SiteScope.exe MemGB : 4884
perfmon.exe MemGB : 282
svchost.exe MemGB : 172
powershell.exe MemGB : 125

I am splitting the process name and memory usage again using regex. Once i do that there is be 5 process names but many numbers of memory usage values (during the selected time frame). I want to do a timechart for memory usage but it is not coming up correctly. When i do a table for Processname and memory, each event is coming up with 5 proc names and mem usage. How do i split them into separate events?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You would need mvexpand command to split a multivalued field. Give this a try

index = tso_operations sourcetype = sitescope_monitorstate host = tsmonw24prdv "[TSMONW46PRDV] Top 10 Proc_Mem" | rex max_match=5 "Name\s+:\s+(?<Process>\S+\sMemGB\s:\s\d+)" | mvexpand Process | rex field=Process "^(?<Process>\w+).exe\sMemGB\s:\s(?<MemGB>\d+)" | timechart max(MemGB) by Process limit=0 

View solution in original post

Ultra Champion

Isn't this info also available from the top input in the Nix TA? I thought both Win and Nix TAs had nice definitions of data collections and sourcetypes for this type of info.

0 Karma

SplunkTrust
SplunkTrust

You would need mvexpand command to split a multivalued field. Give this a try

index = tso_operations sourcetype = sitescope_monitorstate host = tsmonw24prdv "[TSMONW46PRDV] Top 10 Proc_Mem" | rex max_match=5 "Name\s+:\s+(?<Process>\S+\sMemGB\s:\s\d+)" | mvexpand Process | rex field=Process "^(?<Process>\w+).exe\sMemGB\s:\s(?<MemGB>\d+)" | timechart max(MemGB) by Process limit=0 

View solution in original post

Communicator

That worked. Thank you very much.

0 Karma

SplunkTrust
SplunkTrust

Is the sample data a single event or multiple events?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Legend

Please share your query (including the regex)

0 Karma

Communicator

index = tsooperations sourcetype = sitescopemonitorstate host = tsmonw24prdv "[TSMONW46PRDV] Top 10 ProcMem" | rex maxmatch=5 "Name\s+:\s+(?\S+\sMemGB\s:\s\d+)" | rex field=Process "(?^\w+).exe\sMemGB\s:\s(?\d+)"

0 Karma