Splunk Search

Using rex to extract a field from transactioned event

markthompson
Builder

Hi,
I'm trying to extract 2 fields from a transacted search, one for the max and one for the usage.

looks like;

2015-03-12 12:10:11,180 INFO metrics - type=GAUGE, name=heap.max, value=1908408320
2015-03-12 12:10:11,181 INFO metrics - type=GAUGE, name=heap.used, value=82831232

0 Karma
1 Solution

markthompson
Builder

I have solved this by using;

rex field=_raw "name=heap.max, value=(?<Max>\S+)" | rex field=_raw "name=heap.used, value=(?<Used>\S+)"

View solution in original post

markthompson
Builder

I have solved this by using;

rex field=_raw "name=heap.max, value=(?<Max>\S+)" | rex field=_raw "name=heap.used, value=(?<Used>\S+)"

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!