index=* sourcetype=mysourcetype check_command=disk hostname=myhostname | dedup hostname | rex mode=sed "s/(\"\_(\/|\/[a-zA-Z\/]+))\"/\1_used\"/g" | rex max_match=0 "(?<bbb>\"\_(\/|\/[a-zA-Z\/]+)\_\w+\"\:\d+\.\d+\,)" | table bbb | eval aaa=mvsort(bbb) | rex max_match=0 field=aaa "\_(?<path>(\/|\/[a-zA-Z\/]+)\_used)\"\:(?<used>\d+)" | rex max_match=0 field=aaa "_crit\":(?<crit>\d+)" | rex max_match=0 field=aaa "_max\":(?<max>\d+)" | rex max_match=0 field=aaa "_warn\":(?<warn>\d+)" | eval zip=mvzip(path,used,"##") | eval zip=mvzip(zip,crit,"##") | eval zip=mvzip(zip,max,"##") | eval zip=mvzip(zip,warn,"##") | mvexpand zip |rex max_match=0 field=zip "(?<path>.*)##(?<used>.*)##(?<crit>.*)##(?<max>.*)##(?<warn>.*)" | fields - zip | eval used=used/1024/1024 | eval crit=crit/1024/1024 | eval max=max/1024/1024 | eval warn=warn/1024/1024 | eval free=max-used | eval percent=(used/max*100) | eval percent=round(percent,0) | table path free used max percent | rex mode=sed field=path "s/_used//" here is my result, the main event was JSON and the mountpoint were not sorted, so i need to modify first with sed the fields before i can sort i with mvsort correctly. Then i created some more MV-Fields with rex and create an "array" with mvzip. For me, this is a good solution. I can process several fields per event in this way. it performs very well for me. ... View more

You can add on the Indexing-Server following line to props.conf [sourcetype] MAX_TIMESTAMP_LOOKAHEAD = 15 Then Splunk parse only the first 15 characters for the timestamp. Splunk should known the unix-timestamp already. http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Propsconf#Timestamp_extraction_configuration For Events that already in in Splunk you can change it at search time with something like that: | rex "(?yourregularexpresson)" | eval _time = yourtimefield(order_date,"%s") ... View more