Splunk Search

Duplicate nested KV's

mjones414
Contributor

Resource_list_select=ncpus=24:mpiprocs=2:node_class=n24.48+7:ncpus=24:mpiprocs=1:node_class=n24.48

Every once in a while I get an event when there was a problem with an application that this fields data gets duplicate fields appended.

The pieces I'm wanting to pull out of this into individual fields are node_class and ncpu's, but whenever there was an unexpected problem it appends a +with a number and repeats the field.

The rex I've been working on is: ..| rex field=Resource_List_select "\d:node_class=(?.*\d.[0-9]\d)" This grabs the first instance of node_class or ncpu respectively but when there is duplicate entries in the field for each nested field, thats where it gets confused.

How could I revise this regex to grab node_class=n##.## and stop before it gets to a + sign? whenever the data is formatted correctly the delimiter would be the :

Tags (2)
0 Karma
1 Solution

mjones414
Contributor

Success!
rex field=Resource_List_select "(?i):node_class=(?P[^ /+/:]+)"

View solution in original post

mjones414
Contributor

Success!
rex field=Resource_List_select "(?i):node_class=(?P[^ /+/:]+)"

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...