Splunk Search

How to use rex to extract Linux directory sizes and names (Part II)?

edwinmae
Path Finder

Additional question 'to the same scenario': "How to use rex to extract Linux directory sizes and names?"

On other servers where I ran the same script, the output differs when retrieving the data through Splunk. All the information seems to be within the same event now.

1000 dir1
1200 dir2
1550 dir3
Etc.

  .... | rex "(?\d+)\s+(?\w+)" | eval GB=(size/1024)/1024 | timechart mode(GB) as Size by dir

This will give me only the first line, which is 1000 and dir1. How do I extract the sample above so that I have different events for All

If other words -- if | rex "(?\d+)\s+(?\w+)" would do the job for this first line -- how to repeat this for all lines within the same event?

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Use the max_match option in rex:

| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"

Example:

| stats count
| fields - count
| eval _raw = "
   1000 dir1
   1200 dir2
   1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"

Output:

dir     size
-------------------
dir1    1000
dir2    1200
dir3    1550

If you want them all in separate events instead of a multivalued one, you have to use mvexpand:

| stats count
| fields - count
| eval _raw = "
   1000 dir1
   1200 dir2
   1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
| eval size_dir = mvzip(size, dir, "<-->")
| fields - size, dir, _raw
| mvexpand size_dir
| rex field=size_dir "(?<size>\d+)<-->(?<dir>\w+)"
| fields - size_dir

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Consider using the multikv command. It converts tabular event data into separate events for each row of the table.

---
If this reply helps you, Karma would be appreciated.
0 Karma

javiergn
SplunkTrust
SplunkTrust

Use the max_match option in rex:

| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"

Example:

| stats count
| fields - count
| eval _raw = "
   1000 dir1
   1200 dir2
   1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"

Output:

dir     size
-------------------
dir1    1000
dir2    1200
dir3    1550

If you want them all in separate events instead of a multivalued one, you have to use mvexpand:

| stats count
| fields - count
| eval _raw = "
   1000 dir1
   1200 dir2
   1550 dir3"
| rex max_match=0 "(?<size>\d+)\s+(?<dir>\w+)"
| eval size_dir = mvzip(size, dir, "<-->")
| fields - size, dir, _raw
| mvexpand size_dir
| rex field=size_dir "(?<size>\d+)<-->(?<dir>\w+)"
| fields - size_dir

edwinmae
Path Finder

This worked for me. Thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...