Splunk Search

How to split my sample events using regular expression

prathapkcsc
Explorer

Hi,
i have a sample data file like this, all columns are tab separated

TYPE                            Category             Count           CPU Usage (%)
Data Node                       Hadoop                26               0.17
Flume                           Hadoop                9                0.2
ResourceManager                 Hadoop                2                0.06
Hadoop                          ZooKeeper             5                0.19
Foyer                           Hadoop                2                0.28
Splunk                          Hadoop                1                0.06
RabbitMQ                        Non-Hadoop            7                0.98
PostGreSQL                      Non-Hadoop            3                0.11
TC_Server                       Non-Hadoop            12               0.67
Edge                            Hadoop                2                0.19

i want to import this into Splunk and need to split this data.
Finally, i need all the values in table format.
Thank you

0 Karma

woodcock
Esteemed Legend

You need multikv like this:

|makeresults
| eval _raw = "TYPE                            Category             Count           CPU Usage (%)
Data Node                       Hadoop                26               0.17
Flume                           Hadoop                9                0.2
ResourceManager                 Hadoop                2                0.06
Hadoop                          ZooKeeper             5                0.19
Foyer                           Hadoop                2                0.28
Splunk                          Hadoop                1                0.06
RabbitMQ                        Non-Hadoop            7                0.98
PostGreSQL                      Non-Hadoop            3                0.11
TC_Server                       Non-Hadoop            12               0.67
Edge                            Hadoop                2                0.19"
| multikv forceheader=1
0 Karma

prathapkcsc
Explorer

I don't want to hard code the values. Dynamically it has to take the event.

0 Karma

prathapkcsc
Explorer

Please can you provide me the solution?
I want to avoid that copying data, How do i make it dynamic

0 Karma

woodcock
Esteemed Legend

Don't be silly; the hardcoding wasy to show you that multikv works. Just add this to the bottom of your existing search:

... | mulitkv forceheader=1 | table *

See?

0 Karma

prathapkcsc
Explorer

I didn't understand.
Please explain me clearly.
Thank you

0 Karma

somesoni2
SplunkTrust
SplunkTrust

prathapkcsc
Explorer

Can you provide me the regular expression?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How does your data looks in Splunk? Does all these lines comes as part of single event OR each line is separate event?

If it's all coming as single event, you run search like this (will treat the event as table, split into rows with first line as header)

your base search | multikv 

If each line is coming as separate event, then you can do like this

your base search | rex "(?<TYPE>.+)\t(?<Category>.+)\t(?<Count>.+)\t(?<CPU_Usage_Perc>.+)"
0 Karma

prathapkcsc
Explorer

No, Above data is a single event.

0 Karma

prathapkcsc
Explorer

Its not working. I changed the files, but no use.

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi,

how about that

(?:^\s*?)(?<TYPE>[^\t]+)(?:[\t\s]+)(?<Category>[^\t]+)(?:[\t\s]+)(?<Count>[^\t]+)(?:[\t\s]+)(?<CPU_Usage>[^\t]+)(?:[\t\s]+)?
0 Karma

prathapkcsc
Explorer
base search   |  rex " .*?(?:^\s*?)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)? " | table Type,CPU_Usage 

I am not getting any data.

0 Karma

horsefez
SplunkTrust
SplunkTrust

this is the wrong usage of the rex-command

... | rex field=_raw "(?:^\s*?)(?<TYPE>[^\t]+)(?:[\t\s]+)(?<Category>[^\t]+)(?:[\t\s]+)(?<Count>[^\t]+)(?:[\t\s]+)(?<CPU_Usage>[^\t]+)(?:[\t\s]+)?" | ...
0 Karma

prathapkcsc
Explorer
 rex field=_raw "(?:^\s*?)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)(?[^\t]+)(?:[\t\s]+)?" | table TYPE Category 

i tried the above query.
The entire data coming only in single row ( in TYPE).

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@prathapkcsc - Just so you know, there is special markup language on this site so certain symbols will transform your post. If you wrap a word in the asterisk symbol * or _, without wrapping it in a code sample, it will italicize the word. If you wish to show the * (i.e. you are displaying sample code or search), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that the * will display.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...