Splunk Search

Regex multiple fields extraction and graph

nirt
Path Finder

Hi All,
I have a website which produces statistics and it is shown like this(over 1K lines, so just pasting a few)
Each line is produced for each server(e.g there are 2/3 servers) which are seperated by
:

<3>
null

<2>
RealDBMisc.aborted.hod.-1.number = 0
RealDBMisc.aborted.hod.-1.total = 0
RealDBMisc.aborted.hod.-1.avarage = 0
UserDBMisc.aborted.hod.-1.number = 0
UserDBMisc.aborted.hod.-1.avarage = 0
UserDBMisc.aborted.hod.-1.total = 0
ipc.Routing.RouteCostRequest.success.hod.-1.total = 15204
ipc.vs-changeVenueProduct.success.hod.-1.number = 82


The statistics are for the past hour, so the collection is also per hour
I'm looking for a regex syntax to help me filter fields and create graphs, for example I want a graph to show me the numbers after UserDBMisc.aborted.hod.-1.avarage for a custom time

Thanks in advance

Tags (2)
0 Karma

ayme
Splunk Employee
Splunk Employee

Something like this?:

sourcetype=yourdata | rex max_match=99999 field=your_field_holding_all_values "(?<yourfield>[^\n]+)"  | mvexpand yourfield | search yourfield="ipc.DDBRemoveCache.alerts.success.hod.-1.total*" | rex field=yourfield "(?P<field>[^\=]+)=(?P<value>.*)" | table field, value
0 Karma

sandeep_at_func
Explorer

I'm a little fuzzy on understanding this one, is that one event? It might help (me and others) to see what three events would like like from this source. I'm sure we can figure it out 🙂

0 Karma

nirt
Path Finder

Small correction:
I have a source that gives a lot of statistic information, each line is different content
for example:
pc.DDBRemoveCache.alerts.success.hod.-1.total = 527
ipc.DDBRemoveCache.alerts.success.hod.-1.avarage = 1
ipc.DDBRemoveCache.alerts.success.hod.-1.number = 527
ipc.DDBUpdateCache.alerts.success.hod.-1.number = 161
ipc.DDBUpdateCache.alerts.success.hod.-1.total = 161
ipc.DDBUpdateCache.alerts.success.hod.-1.avarage = 1

so it's quite simple: name = value
but I can't seem to get the regex properly working

0 Karma

nirt
Path Finder

One event gives out over 1000 lines of data, each line is a statistic event, however those events can be in multiple servers(divided by the such as <2>)
I need somehow to tell Splunk to know those fields so I can create graphs on each field as I wish

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...