Splunk Search

generating regex

harsh1734
New Member

hi ,
in my log files their is field known as CPU TIME..

which has values:-
Jan 16 12:51:35 Phase 1 ended (674 seconds)
CPU TIME status skew vertex
0.127 [ :12] 0% DLY_INT_Aggregate.abc
3.648 [ : 1] 0% DLY_INT_Aggregate.mpp
185.167 [ :12] 2% DLY_INT_Aggregate.nhu
1132.38 [ :12] 25% DLY_INT_Aggregate.nhr

like this,there 1000 number of values of differnt phases, but when i am trying to extract that by picking any of the value like 0.127 it not picking up the entire set, more over when i am extracting cpu time by passing highest value like 1132.38 it showing an error regex can be generated..
ao what should be the regex so that it can extract all the cpu fields values.

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Are you using multikv to extract out the indivdual fields? If you share your configuration settings then perhaps someone can help you.

http://www.splunk.com/view/SP-CAAAFTU
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Multikv

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...