Splunk Search

Multi value regex

theouhuios
Motivator

Hello

I am trying to extract multiple values of single field name.

 SysStatsUtilizationDiskSpace=17.58% /, SysStatsUtilizationDiskSpace=11.25% /storedconfig, SysStatsUtilizationDiskSpace=7.11% /tmp, SysStatsUtilizationDiskSpace=6.37% /localdisk, SysStatsUtilizationDiskSpace=11.15% /boot,

Here I am trying to extract the value without % and also the filesystem for it. I am using the MV_ADD , but it doesn't actually work. Do I need to define two stanzas for it to work? The reason why I am doing this is because I want it to be like disk_boot = 11.15 . Any ideas?

[disk_space]
REGEX = DiskSpace\=([^%]+)\%\s+\/([^,]*)\,
FORMAT = disk_$2::$1
MV_ADD = True
Tags (1)
0 Karma

emiller42
Motivator

Unfortunately, you can't do concatentated fields in search-time extractions. I would recommend doing something like:

[disk_space]
REGEX = DiskSpace\=([^%]+)\%\s+(/[^,]*)\,
FORMAT = diskSpace::$1 filesystem::$2

(I modified the regex to include the leading / in the filesystem, that way you don't get null values for diskSpace)

This will give you events with the following:

diskSpace=17.58 filesystem="/"
diskSpace=11.25 filesystem="/storedconfig"
diskSpace=7.11 filesystem="/tmp"
etc
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...