I have a events like below in my servers so I want write a search to extract tps(cur)
value in a table format with _time it is occurred. I have tried regex as well as the Field Extractor, but nothing has worked. Any help is greatly appreciated.
Nov 28, 2015 3:57:59 AM com.xxrklogic.developer.XXX.Monitor monitorResults
INFO: completed all tasks 1428872/1428872, 548 tps(avg), 612 tps(cur), ETC 00:00:00, 0 active threads.
try this:
<your search>| rex field=_raw "\s+(?<tpscur>\d+)\s+tps\(cur\)" | table _time tpscur
off course if you intend to use this often just do a field extraction so you dont have to use the rex command in que search
Have you tried testing your regular expression with a tool like https://www.debuggex.com/ ? If you post the full search string that has failed for you (including the regex command) we can help you with your regex