Splunk Search

generating regex

harsh1734
New Member

hi ,
in my log files their is field known as CPU TIME..

which has values:-
Jan 16 12:51:35 Phase 1 ended (674 seconds)
CPU TIME status skew vertex
0.127 [ :12] 0% DLY_INT_Aggregate.abc
3.648 [ : 1] 0% DLY_INT_Aggregate.mpp
185.167 [ :12] 2% DLY_INT_Aggregate.nhu
1132.38 [ :12] 25% DLY_INT_Aggregate.nhr

like this,there 1000 number of values of differnt phases, but when i am trying to extract that by picking any of the value like 0.127 it not picking up the entire set, more over when i am extracting cpu time by passing highest value like 1132.38 it showing an error regex can be generated..
ao what should be the regex so that it can extract all the cpu fields values.

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Are you using multikv to extract out the indivdual fields? If you share your configuration settings then perhaps someone can help you.

http://www.splunk.com/view/SP-CAAAFTU
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Multikv

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...