Splunk Search

Field Extraction from space-aligned fields in multi-line events

landen99
Motivator

From events of the form:

Filesystem                  Type              Size        Used       Avail      UsePct    MountedOn
/dev/mapper/stuff1          ext4               50G        3.4G         44G          8%    /
/dev/mapper/stuff2          ext4              485M         86M        374M         19%    /boot
/dev/mapper/stuff3          ext4              926G        245M        879G          1%    /home
/dev/mapper/stuff4          ext4              9.9T        4.8T        4.7T         51%    /opt

These need to be accepted into fields and displayed in a chart.

0 Karma
1 Solution

landen99
Motivator
index=os sourcetype=df host="host11" |  rex max_match=4 field=_raw ".*?\n(?<Filesystem>[^F]\S+)\s+(?<Type>\S+)\s+(?<Size>\S+)\s+(?<Used>\S+)\s+(?<Avail>\S+)\s+(?<UsePct>\S+)\s+(?<MountedOn>\S+)"  | table _time Filesystem, Type, Size, Used, Avail, UsePct, MountedOn

View solution in original post

0 Karma

landen99
Motivator
index=os sourcetype=df host="host11" |  rex max_match=4 field=_raw ".*?\n(?<Filesystem>[^F]\S+)\s+(?<Type>\S+)\s+(?<Size>\S+)\s+(?<Used>\S+)\s+(?<Avail>\S+)\s+(?<UsePct>\S+)\s+(?<MountedOn>\S+)"  | table _time Filesystem, Type, Size, Used, Avail, UsePct, MountedOn
0 Karma

landen99
Motivator

Looks like multikv works too with much less regex knowledge, but the result has each line as a separate table entry:

index=os sourcetype=df host="host11" | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | table _time Filesystem, Type, Size, Used, Avail, UsePct, MountedOn
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...