Here is the logged event:
SepsisGraphBuilderImpl: 11252495 MS
VitalsGraphBuilderImpl: 2257 MS
Mic2GraphBuilder: 358360 MS
RasGraphBuilderImpl: 201 MS
PatientInfoGraphBuilder: 1992 MS
InterventionEventGraphBuilderImpl: 372 MS
ObservationInfoGraphBuilder: 42472 MS
DrugOrderGraphBuilder: 31849 MS
SurgeryAndRadiologyGraphBuilder: 232 MS
I am wanting to grab each graphbuilder and the time in MS. I thought this search would work, but I am only getting Mic2GraphBuilder:
host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder*): (?<totalms>\d+) MS" | table object, totalms
Your regex is looking for words that end with "GraphBuilde" and any number of r's on the end. Try this
host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS" | table object, totalms
If you have one graphbuilder/time pair per event then this will work. If you have multiple pairs per event then you will have to add max_match=0
to the rex command and then process the object and totalms fields as multi-valued fields.
Without a Splunk in front of me, I wonder if it's actually be easier to use extract with perhaps untable something like...
host=s*gs* *GraphBuilder* | extract kvdelim=":" | untable _time object totalms
There may be some eval to clean up but it seems like it'd be easier than fighting regular expressions to make multi valued fields.
Unfortunately there is some text before and afterwards that interfere
Your regex is looking for words that end with "GraphBuilde" and any number of r's on the end. Try this
host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS" | table object, totalms
If you have one graphbuilder/time pair per event then this will work. If you have multiple pairs per event then you will have to add max_match=0
to the rex command and then process the object and totalms fields as multi-valued fields.
how do you then parse the multi-valued fields as pairs?
You combine the two multi-valued fields and then expand them into separate events. Then you process each event as you normally would. Something like this.
host=s*gs* *GraphBuilder* | rex field=_raw "(?<object>\w+GraphBuilder\w*): (?<totalms>\d+) MS" | eval pairs=mvzip(object,totalms) | mvexpand pairs | ...