the SPL is a mixture of your suggested but i just made a few modification (which is probably all wrong) lol   | rex field="show chassis cluster status _ no_more" max_match=0 "(?s)Monitor-failures[\n][\n](?<Redundancy_group>.*)[\n][\n]" | fields Redundancy_group | rex "(?<group>Redundancy.*)" | rex "(?<node>node.*)" | filldown group | where isnotnull(node) | eval result=group . "," . group |table group node result     desired result is still the original 🙂 desired result.   Redundancy group: 0 , Failover count: 0,node0 200 primary no no None Redundancy group: 0 , Failover count: 0,node1 2 secondary no no None Redundancy group: 1 , Failover count: 0,node0 200 primary no no None Redundancy group: 1 , Failover count: 0,node1 2 secondary no no None Redundancy group: 2 , Failover count: 0,node0 200 primary no no None Redundancy group: 2 , Failover count: 0,node1 2 secondary no no None ... View more

hi @yuanliu  i was able to follow it when the data is from what i pasted. here is the raw output. i was wondering if you can work your magic, it just dont work for me when i use the raw data.   Oct 11 11:32:45 node0: -------------------------------------------------------------------------- /var/crash/*core*: No such file or directory -rw-rw---- 1 nobody wheel 1251399200 Oct 11 10:29 /var/tmp/C1.core.0.gz -rw-rw---- 1 nobody wheel 1254654282 Oct 11 10:27 /var/tmp/C3.core.0.gz -rw-rw---- 1 nobody wheel 1093812660 Mar 11 2022 /var/tmp/C0.core.0.gz -rw-rw---- 1 nobody wheel 1255530083 Oct 11 10:24 /var/tmp/IC1.core.0.gz -rw-rw---- 1 nobody wheel 184401920 Mar 11 2022 /var/tmp/IC2.core.0.gz -rw-rw---- 1 nobody wheel 1251262474 Mar 1 2022 /var/tmp/IC3.core.0.gz -rw-rw---- 1 nobody wheel 1256350152 Oct 12 10:21 /var/tmp/IC3.core.1.gz /var/tmp/pics/*core*: No such file or directory /var/crash/kernel.*: No such file or directory /var/jails/rest-api/tmp/*core*: No such file or directory /tftpboot/corefiles/*core*: No such file or directory /jail/var/tmp/*core*: No such file or directory total files: 7 node1: -------------------------------------------------------------------------- /var/crash/*core*: No such file or directory -rw-rw---- 1 nobody wheel 34766848 Mar 2 2022 /var/tmp/IC3.core.0.gz -rw-rw---- 1 nobody wheel 1151312299 Mar 1 2022 /var/tmp/IC0.core.0.gz -rw-rw---- 1 nobody wheel 1153074056 Mar 1 2022 /var/tmp/IC1.core.0.gz -rw-rw---- 1 nobody wheel 1158385356 Mar 1 2022 /var/tmp/IC2.core.0.gz -rw-rw---- 1 nobody wheel 1150786252 Mar 1 2022 /var/tmp/IC3.core.0.gz -rw-rw---- 1 root wheel 140366826 Dec 14 2021 /var/tmp/2d.core-tarball.0.tgz -rw-rw---- 1 root wheel 140020614 Feb 12 2022 /var/tmp/b2d.core-tarball.1.tgz /var/tmp/pics/*core*: No such file or directory /var/crash/kernel.*: No such file or directory /var/jails/rest-api/tmp/*core*: No such file or directory /tftpboot/corefiles/*core*: No such file or directory /jail/var/tmp/*core*: No such file or directory total files: 7 {primary:node0} ... View more

@richgalloway  here you go.   Nov 27 13:36:45 Monitor Failure codes: CS Cold Sync monitoring FL Fabric Connection monitoring GR GRES monitoring HW Hardware monitoring IF Interface monitoring IP IP monitoring LB Loopback monitoring MB Mbuf monitoring NH Nexthop monitoring NP NPC monitoring SP SPU monitoring SM Schedule monitoring CF Config Sync monitoring RE Relinquish monitoring IS IRQ storm Cluster ID: 1 Node Priority Status Preempt Manual Monitor-failures Redundancy group: 0 , Failover count: 0 node0 200 primary no no None node1 2 secondary no no None Redundancy group: 1 , Failover count: 2 node0 200 primary no no None node1 20 secondary no no None Redundancy group: 2 , Failover count: 2 node0 200 primary no no None node1 2 secondary no no None {primary:node0} ... View more

@richgalloway  hi rich, im sorry, i tried to use exact code you gave and it didnt work, so i kinda tried some other stuff. as far as the data. it is what i sent. attach is the image. but when i try to use yours which looks similar/identical to the one here its not. i am thinking its something to do with the formatting of splunk when i paste the output here.     ... View more

Hi @richgalloway ,   when i copy your code directly it works well, and is exactly what i want. but when i use the actual data i got it working till the last '| eval result=group . "," . node'. it does not seem to provide any output as shown below in RESULT. . im thinking maybe cause it has spaces in between the original one? here is the output of the result. splunk i think reformats and removes some of the tabs/spaces in between the original. | rex field=Redundancy_group mode=sed "s/\n\n/\n/g" | rex field=Redundancy_group max_match=0 "(?<group>Redundancy.*)" | rex field=Redundancy_group max_match=0 "(?<node>node.*)" | filldown group | where isnotnull(node) | eval result=group . "," . group |table group node result group node result Redundancy group: 0 , Failover count: 0 Redundancy group: 1 , Failover count: 2 Redundancy group: 2 , Failover count: 2 node0 200 primary no no None node1 2 secondary no no None node0 200 primary no no None node1 20 secondary no no None node0 200 primary no no None node1 2 secondary no no None   ... View more

hi @richgalloway that is correct. its basically just node0 and node1 because its below redundancy group0 for example. so each redudancy group 1,2,3 has their own Node0 and Node1 output. would simply want to group them in 1 line. hope it makes sense.   ... View more

@bowesmana    quick question on this output. how can i modify it, if there are multiple Temperature fields under node0? how can i capture the other Temperature values under the same node #? | rex max_match=0 "(?s)(?<nodeNum>node\d+):.*?Temperature\s+(?<temp>[^\n]*)" | eval Temps=mvzip(nodeNum, temp, "=")   ... View more

@yuanliu  hi appreciate the help but didnt seem to work. can i bug you for an easier but similar help? maybe it will help me better understand since i am a novice with splunks.   here is my data: node0: /hello /hi -rw-rw---- bad1.gz -rw-rw---- bad2.gz /bye node1: /hello/hello /hi/hi -rw-rw---- bad3.gz /bye/bye   how can i simply group them based on node0 and node1? using rex and mvzip for example or some other variations. output would be: node0:/hello node0:/hi node0:-rw-rw---- bad1.gz node0:-rw-rw---- bad2.gz node0:/bye node1,/hello/hello node1,/hi/hi node1,-rw-rw---- bad3.gz node1,/bye/bye   hope this helps. 🙂 again really thank you     ... View more

@bowesmana  thank you,   i will do that, if i can make it easier for you. using the same search string you gave me. how can i modify it so that it grabs every single line.   node0: -------------------------------------------------------------------------- /var/: No such file or directory /var/tmp/: No such file or directory /var/: blablablaba.txt node1: -------------------------------------------------------------------------- /var/: No such file or directory /var/tmp/: No such file or directory   output expecting: node0,/var/: No such file or directory node0,/var/tmp/: No such file or directory node0,/var/: blablablaba.txt node1,/var/: No such file or directory node1,/var/tmp/: No such file or directory   ... View more

this is my current search but it does not seem to get the other lines below.. its only checking 1 line from each group of node0 and node1 😞   |data | rex field="core_dump" max_match=0 "(?s)(?<nodeNum>node\d+):.*?------------------------*[\n](?<coredumpoutput>[^\n]*)" |table nodeNum coredumpoutput   output: nodeNum coredumpoutput node0 node1 /var/crash/*core*: No such file or directory /var/crash/*core*: No such file or directory ... View more

hi @yuanliu  thanks for the quick reply. i think i need more help to further clarify. so this is the Raw data (but splunk under verbose mode, it was able to consider this as a field named "core dumps" node0: -------------------------------------------------------------------------- /var/: No such file or directory /var/tmp/: No such file or directory /var/: blablablaba.txt node1: -------------------------------------------------------------------------- /var/: No such file or directory /var/tmp/: No such file or directory   what i would like to do, is do a rex max_match where it would create values that would look like this first. FIRST OUTPUT: node0,/var/: No such file or directory node0,/var/tmp/: No such file or directory node0,/var/: blablablaba.txt node1,/var/: No such file or directory node1,/var/tmp/: No such file or directory   from here i would like to then display all lines that do not have "No such file or directory" so the final output will be: node0,/var/: blablablaba.txt   i hope this makes it more clearer. i do apologize for making it confusing. ... View more

@bowesmana i got a new one.   using similar regex. how can i do a query where it will provide output if will provide output per NODE0 or NODE1 and display only if each line after "/var" if the line does not have "no such file or directory"   node0: -------------------------------------------------------------------------- /var/: No such file or directory /var/tmp/: No such file or directory /var/: blablablaba.txt node1: -------------------------------------------------------------------------- /var/: No such file or directory /var/tmp/: No such file or directory   so the output will end up being: NODE0: /var/: blablablaba.txt NODE1: null/blank/nothing ... View more

sorry me again, what if i wanted to add a third paramater? example 'last reboot reason' ? haha im stuck yet again @richgalloway  ... View more

thank you very much, this worked really well.. 🙂 @richgalloway  i may ask for a few more help later on. 🙂   thank you also @bowesmana for the help. ... View more

hi thank you very much for replying.   this is the raw data, and one event.   within that event, splunk extracted the output provided, as a single field. so technically you can ignore about the field, treat this as a single event. 🙂 ... View more