Hello,
I have an issue with this type of log :
[5/22/20 14:46:23:381 GMT] 0000009c ThreadMonitor 3 UsageInfo[ThreadPool:hung/active/size/max]={server.startup:0/0/1/3,ProcessDiscovery:0/0/1/2,TCPChannel.DCS:0/2/4/20,HAManager.thread.pool:0/0/2/2,Default:0/2/6/20}
I create a regex which works :
rex field=_raw "\[(?[^\[]*)\]\s(?[^\s]*)\s(?[^\s]*)\s(?[^\s]*)\s(?.{11})(?\[\w.*\])(?[\=])\{((?\w.*?):(?\d+)\/(?\d+)\/(?\d+)\/(?\d+))+" | table timestamp threadname hung max
But the threadname is always the first match, in my case server.startup.
Is it possible to add a where clause to extract the desired threadname, for example HAManager ?
And I can't modify props.conf because I don't have admin right.
Thanks for your help
David
1) Always mark your code so HTML-like aspects <threadname>
don't get stripped out by the forum.
2) If you want to find all matches, use the max_match=0
parameter to get all matches for your rex
.
3) if you are looking for only the value of a fixed name like HAManager.thread.pool:0/0/2/2,
, then just use that name as your rex.
| rex field=_raw "HAManager.thread.pool:(?<threadpoolvalue>[^,]+)"
4) If you are looking for ALL values, then rex JUST the relevant matchable items.
| rex field=_raw max-match=0 "\b(?<threadpoolname>[^:]+):(?<threadpoolvalue>\d+\/\d+\/\d+\/\d+)\b"
Those are aircode, so they may require some adjustment.
1) Always mark your code so HTML-like aspects <threadname>
don't get stripped out by the forum.
2) If you want to find all matches, use the max_match=0
parameter to get all matches for your rex
.
3) if you are looking for only the value of a fixed name like HAManager.thread.pool:0/0/2/2,
, then just use that name as your rex.
| rex field=_raw "HAManager.thread.pool:(?<threadpoolvalue>[^,]+)"
4) If you are looking for ALL values, then rex JUST the relevant matchable items.
| rex field=_raw max-match=0 "\b(?<threadpoolname>[^:]+):(?<threadpoolvalue>\d+\/\d+\/\d+\/\d+)\b"
Those are aircode, so they may require some adjustment.
Thanks @DalJeanis I have modified my request by adding a fixed name and it's work fine.
I will modify my original post to display the code @richgalloway .
Thanks both of you.
David
I've formatted the question to display the query as code. Please edit it to show the correct regular expression.