hi ,
in my log files their is field known as CPU TIME..
which has values:-
Jan 16 12:51:35 Phase 1 ended (674 seconds)
CPU TIME status skew vertex
0.127 [ :12] 0% DLY_INT_Aggregate.abc
3.648 [ : 1] 0% DLY_INT_Aggregate.mpp
185.167 [ :12] 2% DLY_INT_Aggregate.nhu
1132.38 [ :12] 25% DLY_INT_Aggregate.nhr
like this,there 1000 number of values of differnt phases, but when i am trying to extract that by picking any of the value like 0.127 it not picking up the entire set, more over when i am extracting cpu time by passing highest value like 1132.38 it showing an error regex can be generated..
ao what should be the regex so that it can extract all the cpu fields values.
Are you using multikv to extract out the indivdual fields? If you share your configuration settings then perhaps someone can help you.
http://www.splunk.com/view/SP-CAAAFTU
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Multikv