field extraction help

[a212830]

Hi,

I'm a relative newbie (power noob?) who is having issues with extracting fields from a multi-line event. A sample is below. I need to parse out each one into field. I tried grabbing the beginning of the field to the end, but I'm not getting anything. Any ideas? -- \tTCPIP\s(?.+)%
(Not looking for each one - figured if I get one correct, the others would be similiar...)

StartEvent Tue May 22 15:25:33 EDT 2012 ***
CPU 0 17%
Object Store 10%
HTTP and FTP 2%
Access Logging 2%
Miscellaneous 1%
CPU 1 41%
TCPIP 18%
HTTP and FTP 16%
Policy evaluation - HTTP 5%
DNS service 1%

[sdaniels · Accepted solution]

Assuming you have the line breaking right for the whole event...this works for me to extract the TCPIP %age:

Updated:

TCPIP\\s+(?<tcpip>.+)%  

Not sure what you have at the beginning of yours with '--t'

[a212830]

Thanks to you both. Just started reading my "Mastering Regular Expressions" book!

[Ayn]

TCPIP\s+(?<tcpip>\S+)%

[a212830]

this grabs all the whitespace that is between TCPIP and the end value. Is there anyway to strip out that whitespace? I want to go from TCPIP to the %, and grab the value just before the %.