Splunk Search

Solaris df log - fields extraction

lanying
Explorer

I'm collecting a disk space log.
I want to extract fields.
==> Filesystem , Type , Size , Used , Avail , UsePct , MountedOn

I don't know that regular expression & how to make it. Please explain the method.


Filesystem Type Size Used Avail UsePct MountedOn

/dev/mapper/VolGroup00-LogVol00 ext3 88G 11G 73G 13% /

/dev/sda2 ext3 99M 21M 74M 22% /boot
host=splunkH | source=df | sourcetype=df

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi lanying

basically you can use the docs to setup field extraction. This should give you all the necessary hints to setup field extraction.

as for the regex; I'm not the super-über-hero in regex but to get Type Size Used Avail UsePct you could use \s{1}\w+ as regex.

One think to consider: in larger scale environments, prefer search time field extraction over index time field extraction, because of performance reasons

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...