I have a script for Linux that executes "sar -n DEV" and formats the output to look like:
Linux <kernel version> (<hostname>) <date> <arch> (<#> CPU)
Average: <interface> <field1> <field2> <field3>
Average: <interface> <field1> <field2> <field3>
Average: <interface> <field1> <field2> <field3>
Using Splunk Web's field extractor, I have a regex that applies field extraction to the first "Average:" line. How do I make it so the field is applied to as many "Average:" lines exist?
| makeresults
| eval _raw="
Linux <kernel version> (<hostname>) <date> <arch> (<#> CPU)
Average: <interface> <field1> <field2> <field3>
Average: <interface> <field1> <field2> <field3>
Average: <interface> <field1> <field2> <field3>"
| rex max_match=0 "(?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)"
try REGEX option (?ms)
and max_match
transforms.conf
[your stanza]
REGEX = (?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)
MV_ADD = true
I haven't try this. how about this?
| makeresults
| eval _raw="
Linux <kernel version> (<hostname>) <date> <arch> (<#> CPU)
Average: <interface> <field1> <field2> <field3>
Average: <interface> <field1> <field2> <field3>
Average: <interface> <field1> <field2> <field3>"
| rex max_match=0 "(?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)"
try REGEX option (?ms)
and max_match
transforms.conf
[your stanza]
REGEX = (?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)
MV_ADD = true
I haven't try this. how about this?
Would I have to make one REPORT entry per field or can I combine them all into one if I try to do this as a search-time extraction? I saw a key in transforms.conf that could apply for what I'm trying to do (MV_ADD).
yes, REGEX
and MV_ADD
is. my answer is updated.