=Application
SourceName=RGFXQA
EventCode=55
EventType=3
Type=Warning
ComputerName=UPS6Z445201Y3.upstreamaccts.XOM.com
TaskCategory=%1
OpCode=Info
RecordNumber=106286
Keywords=Classic
Message=C: has 114.6 GB free of 222.5 GB Total.
I have the above event where type, soucername, keywords, message etc are fields. How can I make the 114.4 GB
a field called freespace and 222.5 GB
as available space
Use rex
your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...
Use rex
your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | ...
Thank you so much brother.how can I do the freespace percentage like freespace%=(totalspace-freespace)/100.I tried using the eval command but it is not working.Can you please help in this
This should do it
... | eval pcfree=freespace/totalspace*100 | ...
I tried using your command but it is showing all blank
Does
your search | rex field=Message "has (?<freespace>.+ GB) free of (?<totalspace>.+ GB)" | table freespace totalspace
show any data?