rex usage in splunk

[dutabhis07]

Hi,
i am trying to create a pie chart with gives %age up and down time of a system.
Splunk mines a log file with the below format giving the system availability stat.
If you see below, we have three status System up, down and down due to db failure.
we want to combine both the downs into single category of "Down"
Were using the below query in splunk to get the pie chart but the Down comes up in two different segment.
index=prd sourcetype="nodecheck" | rex "System (?.*)" | chart count by upordown

2014-03-17 15:53:00-SystemA System Up
2014-03-17 15:48:01-SystemA System Up
2014-03-17 15:43:00-SystemA System Up
2014-03-17 15:38:00-SystemA System Up
2014-03-17 15:33:00-SystemA System Up
2014-03-17 15:01:01-SystemA System Down
2014-03-17 15:31:00-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:21:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:11:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:01:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 14:48:00-SystemA System Up
2014-03-17 14:43:00-SystemA System Up

[chimell]

Hi

Try this search code

index=prd sourcetype="nodecheck"|rex field=_raw "System\s+(?<SystemStatus>[^\$|^\!]+)"|chart count by SystemStatus

[somesoni2]

Try this:

index=prd sourcetype="nodecheck" | rex "System\s(?<upordown>\w+)" | chart count by upordown

[grijhwani]

rex "System (?<upordown>) .*"

This should provide you with just the single word following "System"

To be even more flexible you could change it to

rex "System\s(?<upordown>)\s.*"

This will ensure the word breaks happen for any whitespace character not just a space itself.