Splunk Search

How to combine multiple separate fields into one for graphing purposes

hapalmiter
New Member

2017-09-12 12:31:11.817 INFO [RunMaster]
stats: jif: 1, fif: 9, fim: 192, f2c: 183
paper: pc: 9129, uwr: n/a, rwr: n/a
side-a: fa: 0, fmq: 0, fq: 0, fp: 96, #r: 49, frs: 0, f2f ms: 101, fb100 0.00
side-b: fa: 0, fmq: 0, fq: 9, fp: 87, #r: 49, frs: 0, f2f ms: 101, fb200 0.00

I want to pull out the values for fa, fmq, fq, and fp, but also associate them with either side-a or side-b. I want to be able to graph the these values side by side while also showing side-a vs side-b.

Currently I can pull out one sides info into separate fields using this regex: "[.\n]*side-a:\sfa:\s(?\d+),\sfmq:\s(?\d+),\sfq:\s(?\d+),\sfp:\s(?\d+)"

I tried also setting this regex equal to side-a but got no results. Any suggestions on how I am do this?

Thanks.

0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

something like this might be what you're looking for:

index=main source="*mylog.log" host="xyz" | rex field=_raw "side-a: fa:\s+(?<side_a_fa>\d+)\,\s+fmq:\s+(?<side_a_fmq>\d+)\,\s+fq:\s+(?<side_a_fq>\d+)\,\s+fp:\s+(?<side_a_fp>\d+)\,\s+\#r:\s+(?<side_a_r>\d+)\,\s+frs:\s+(?<side_a_frs>\d+)\,\s+f2f\s+ms:\s+(?<side_a_f2f_ms>\d+)\,\s+fb100\s+(?<side_a_fb100>\S+)" | rex field=_raw "side-b:\s+fa:\s+(?<side_b_fa>\d+)\,\s+fmq:\s+(?<side_b_fmq>\d+)\,\s+fq:\s+(?<side_b_fq>\d+)\,\s+fp:\s+(?<side_b_fp>\d+)\,\s+\#r:\s+(?<side_b_r>\d+)\,\s+frs:\s+(?<side_b_frs>\d+)\,\s+f2f\s+ms:\s+(?<side_b_f2f_ms>\d+)\,\s+fb200\s+(?<side_b_fb200>\S+)" | timechart span=1m max(side_a_fa) as "1-side_a_fa" max(side_b_fa) as "1-side_b_fa" max(side_a_fmq) as "2-side_a_fmq" max(side_b_fmq) as "2-side_b_fmq" BY host

View solution in original post

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

alt text

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

something like this might be what you're looking for:

index=main source="*mylog.log" host="xyz" | rex field=_raw "side-a: fa:\s+(?<side_a_fa>\d+)\,\s+fmq:\s+(?<side_a_fmq>\d+)\,\s+fq:\s+(?<side_a_fq>\d+)\,\s+fp:\s+(?<side_a_fp>\d+)\,\s+\#r:\s+(?<side_a_r>\d+)\,\s+frs:\s+(?<side_a_frs>\d+)\,\s+f2f\s+ms:\s+(?<side_a_f2f_ms>\d+)\,\s+fb100\s+(?<side_a_fb100>\S+)" | rex field=_raw "side-b:\s+fa:\s+(?<side_b_fa>\d+)\,\s+fmq:\s+(?<side_b_fmq>\d+)\,\s+fq:\s+(?<side_b_fq>\d+)\,\s+fp:\s+(?<side_b_fp>\d+)\,\s+\#r:\s+(?<side_b_r>\d+)\,\s+frs:\s+(?<side_b_frs>\d+)\,\s+f2f\s+ms:\s+(?<side_b_f2f_ms>\d+)\,\s+fb200\s+(?<side_b_fb200>\S+)" | timechart span=1m max(side_a_fa) as "1-side_a_fa" max(side_b_fa) as "1-side_b_fa" max(side_a_fmq) as "2-side_a_fmq" max(side_b_fmq) as "2-side_b_fmq" BY host

0 Karma

hapalmiter
New Member

This is very helpful! How do I modify it if want every individual event at the time it occurs not the max for a given time interval?

For example I am running this search:

index=pwp-prod press=MP230 stats | rex "[.\n]*side-a:\sfa:\s(?\d+),\sfmq:\s(?\d+),\sfq:\s(?\d+),\sfp:\s(?\d+)" | timechart max(side_a_fa) as "side_a_fa" max(side_a_fq) as "side_a_fq" max(side_a_fp) as "side_a_fp" by event

But some of the events where this is present occur in different time intervals and just want to capture each individual occurrence of this stats block. That is why I added the 'by event' but I am unsure this is what I want.

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

I'm not completely sure I understand what you want the output to look like but you could use values instead of max,min,avg
reduce your span if you are seeing multiple values within one timespan

...| timechart span=1m values(side_a_fa) as "1-side_a_fa" values(side_b_fa) as "1-side_b_fa" values(side_a_fmq) as "2-side_a_fmq" values(side_b_fmq) as "2-side_b_fmq" BY host

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you describe what you want the final results to look like?
If you're using the regex at search time you can use two regex commands to extract side-a and side-b fields (with different field names).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...