Splunk Search

generating regex

harsh1734
New Member

hi ,
in my log files their is field known as CPU TIME..

which has values:-
Jan 16 12:51:35 Phase 1 ended (674 seconds)
CPU TIME status skew vertex
0.127 [ :12] 0% DLY_INT_Aggregate.abc
3.648 [ : 1] 0% DLY_INT_Aggregate.mpp
185.167 [ :12] 2% DLY_INT_Aggregate.nhu
1132.38 [ :12] 25% DLY_INT_Aggregate.nhr

like this,there 1000 number of values of differnt phases, but when i am trying to extract that by picking any of the value like 0.127 it not picking up the entire set, more over when i am extracting cpu time by passing highest value like 1132.38 it showing an error regex can be generated..
ao what should be the regex so that it can extract all the cpu fields values.

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Are you using multikv to extract out the indivdual fields? If you share your configuration settings then perhaps someone can help you.

http://www.splunk.com/view/SP-CAAAFTU
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Multikv

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...