Hi i would like some help to extract each line of data into separate fields of Name, ID, Speed & duplex, state, mac address. critical that "state" is its own field. getting stuck and need help. thank you Data below   name                    id    speed/duplex/state            mac address       -------------------------------------------------------------------------------- ethernet1/3             66    1000/full/up                  b6:2c:23:e0:40:42 ethernet1/4             67    1000/full/up                 b6:2c:23:e0:40:43 ethernet1/5             68    10000/full/up                 b6:2c:23:e0:40:44 ethernet1/6             69    10000/full/up                 b6:2c:23:e0:40:45 ethernet1/7             70    10000/full/up                 b6:2c:23:e0:40:46 ethernet1/8             71    10000/full/up                 b6:2c:23:e0:40:47 ae1                     16    [n/a]/[n/a]/up                b6:2c:23:e0:40:10 ae2                     17    [n/a]/[n/a]/up                b6:2c:23:e0:40:11 ha1-a                   5     1000/full/up                  d1:f4:b3:c3:25:97 ha1-b                   7     1000/full/up                  d1:f4:b3:c3:25:96 vlan                    1     [n/a]/[n/a]/up                b6:2c:23:e0:40:01 loopback                3     [n/a]/[n/a]/up                b6:2c:23:e0:40:03 tunnel                  4     [n/a]/[n/a]/up                b6:2c:23:e0:40:04 hsci                    8     40000/full/up                 01:20:6c:1c:81:08    any help will be appreciated. thanks,  ... View more

  index=testlab sourcetype=testcsv | rex field="status detail" "(?<message_received_name>Messages Received)\\s*[0-9,]*\s*[0-9,]*\s*(?<message_received>[0-9,]*)" | rex field=message_received mode=sed "s/,//g" | eval myInt = tonumber(message_received) | reverse | delta myInt as message_received_delta | timechart span=10m sum(message_received_delta) by Hostname   the problem i find is that when i am doing only 1 hostname at a time. it works just fine. (note the data is incremental counters only). but when i introduce additional hostnames, i see some hostnames would show a negative value. it should only show positive numbers (0 to inifinity) again when i do single host, it works just fine. 🙂 really need help on this one. ... View more

hi i am hoping for some help regarding this. basically i would like to compare (subtract current to previous) the value of REX command on the latest data versus previous events REX command data. today Counters:                       Reset                Uptime              Lifetime Messages Received 13,524,598     13,524,585     13,524,598 Yesterday Counters:                       Reset                Uptime              Lifetime Messages Received 12,524,598     12,524,585     12,524,598   current filter | rex field="status detail" "(?<message_received_name>Messages Received)\\s*[0-9,]*\s*[0-9,]*\s*(?<message_received>[0-9,]*)" | rex field="status detail" "(?<current_time_text>Status as of:)\s*(?<query_time>.*)GMT" | stats latest(message_received_name) as Counter_Name latest(message_received) as Messages_Received latest(query_time) as Query_Time by Hostname   how can i use the same search on the previous event, so i can find the difference of "message_received" thanks, ... View more

hi, i am a bit lost, i am trying to extract some % values of specific parameters. but with no luck example i want to extract the anti-virus value of 12%   this is my command | rex field=_raw "Anti-Spam\s*<(?<cpu>.*)>" Gauges: Current System RAM Utilization 65% Overall CPU load average 43% CPU Utilization MGA 20% Anti-Virus 12% Reporting 0% Quarantine 0% ... View more