Getting Data In

I have events that I need to split out according to an suffixed number on the end of the field names and then summarized with other events for the same Flow Name.

pxs0514
Explorer

All of the fields ending in _1 need to be reported together, then all those ending in _2, etc. The number of suffixed metrics varies from event to event so it will need to be processed like an array until end of event is reached. Can you help?

1st Event Record of 8:
Broker Name: MQS9BRK
Execgrp: STG1TRN3
Flow Name: RetrieveClaimDetails
StartDate: 2016-08-29
StartTime: 10:00
MsgsProc: 34
(Unknown number of Nodes - metrics below associated with the above broker flow)
Nodename_1: AIPService
Nodename_2: COBOLtoKofax
Nodename_3: ClaimsReply
Nodename_4: CobolFault
Nodetype_1: ComputeNode
Nodetype_2: FlowOrderNode
Nodetype_3: SOAPExtractNode
Nodetype_4: ValidateNode
Msgs_1: 34
Msgs_2: 34
Msgs_3: 0
Msgs_4: 10
CPU_1: 46125
CPU_2: 5915
CPU_3: 721949
CPU_4: 0

Search criteria: Broker Name=MQS9BRK Execgrp=STG1TRN3
Flow Name=RetrieveClaimDetails
StartDate=2016-08-29 StartTime=10:00 EndTime=12:00 (need to evaluate a total of eight 15 minute intervals)

End result needed in table for the above search criteria

NodeName NodeType Msgs (sum of all intervals 10-12:00) CPU (sum of all intervals 10-12)
AIPService ComputeNode 272 2343209
COBOLtoKofax FlowOrderNode 272 16324
ClaimsReply SOAPExtractNode 272 983424032
CobolFault ValidateNode 0 0

Tags (3)
0 Karma

sundareshr
Legend

Try this

your base search | extract pairdelim="\n" kvdelim=":" | eval time=strptime(StartDate."T".StartTime, "%Y-%m-%dT%H:%M") | rex max_match=0 field=_raw "Nodename_\d+:\s+(?<nodename>\w+)" | rex max_match=0 field=_raw "Nodetype_\d+:\s+(?<nodetype>\w+)" | rex max_match=0 field=_raw "Msgs_\d+:\s+(?<msgs>\w+)" | rex max_match=0 field=_raw "CPU_\d+:\s+(?<cpu>\w+)" | eval z=mvzip(nodename, mvzip(nodetype, mvzip(msgs, cpu))) | mvexpand z | bin span=15m time | stats sum(msgs) as Msgs sum(cpu) as CPU by time nodename nodetype
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...