Splunk Search

generating regex

harsh1734
New Member

hi ,
in my log files their is field known as CPU TIME..

which has values:-
Jan 16 12:51:35 Phase 1 ended (674 seconds)
CPU TIME status skew vertex
0.127 [ :12] 0% DLY_INT_Aggregate.abc
3.648 [ : 1] 0% DLY_INT_Aggregate.mpp
185.167 [ :12] 2% DLY_INT_Aggregate.nhu
1132.38 [ :12] 25% DLY_INT_Aggregate.nhr

like this,there 1000 number of values of differnt phases, but when i am trying to extract that by picking any of the value like 0.127 it not picking up the entire set, more over when i am extracting cpu time by passing highest value like 1132.38 it showing an error regex can be generated..
ao what should be the regex so that it can extract all the cpu fields values.

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Are you using multikv to extract out the indivdual fields? If you share your configuration settings then perhaps someone can help you.

http://www.splunk.com/view/SP-CAAAFTU
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Multikv

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...