Splunk Search

delta and rex

zachvida
Path Finder

index=os source=df host=host1 | multikv | rex mode=sed "s/%//" | search Filesystem="/dev/mapper/host1.work" | delta UsePct | table *

Without looking at the table it appears the rex command worked. However, no values are shown for the field delta(UsePct) and the '%' remains in the table output

index=os source=df host=host1 | multikv | rex mode=sed field=UsePct "s/%//" | search Filesystem="/dev/mapper/host1.work" | delta UsePct | table *

Values are shown for the field delta(UsePct). No percent remains in the output.

It just seems odd to me that I need to specify the field option for the rex command to get the delta command to actually get a non % based number.

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

If you don't specify a field, rex just operates on the _raw field, which may look like it's working, but hasn't changed the value of UsePct (which was extracted from _raw by the multikv command, prior to the rex command).

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

If you don't specify a field, rex just operates on the _raw field, which may look like it's working, but hasn't changed the value of UsePct (which was extracted from _raw by the multikv command, prior to the rex command).

0 Karma

zachvida
Path Finder

From: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex

Description: Matches the value of the field against the unanchored regex and extracts the Perl regex named groups into fields of the corresponding names. If mode is set to 'sed' the given sed expression will be applied to the value of the chosen field (or to _raw if a field is not specified).

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...