Splunk Search

rex usage in splunk

dutabhis07
Explorer

Hi,
i am trying to create a pie chart with gives %age up and down time of a system.
Splunk mines a log file with the below format giving the system availability stat.
If you see below, we have three status System up, down and down due to db failure.
we want to combine both the downs into single category of "Down"
Were using the below query in splunk to get the pie chart but the Down comes up in two different segment.
index=prd sourcetype="nodecheck" | rex "System (?.*)" | chart count by upordown

2014-03-17 15:53:00-SystemA System Up
2014-03-17 15:48:01-SystemA System Up
2014-03-17 15:43:00-SystemA System Up
2014-03-17 15:38:00-SystemA System Up
2014-03-17 15:33:00-SystemA System Up
2014-03-17 15:01:01-SystemA System Down
2014-03-17 15:31:00-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:21:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:11:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:01:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 14:48:00-SystemA System Up
2014-03-17 14:43:00-SystemA System Up

Tags (1)
0 Karma

chimell
Motivator

Hi

Try this search code

index=prd sourcetype="nodecheck"|rex field=_raw "System\s+(?<SystemStatus>[^\$|^\!]+)"|chart count by SystemStatus
0 Karma

somesoni2
Revered Legend

Try this:

index=prd sourcetype="nodecheck" | rex "System\s(?<upordown>\w+)" | chart count by upordown

grijhwani
Motivator
rex "System (?<upordown>) .*"

This should provide you with just the single word following "System"

To be even more flexible you could change it to

rex "System\s(?<upordown>)\s.*"

This will ensure the word breaks happen for any whitespace character not just a space itself.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...