- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- regex to extract from _raw
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am unfamiliar with regex. I need to separate every field in the _raw data from this line.
06/06 12:46:17 metrics ListeningThreads=3 IdleThreads=21 WaitingThreads=0 BusyThreads=0 TotalThreads=24 DelayedRequests=0 DroppedRequests=0 HandledRequests=28 HandledTime=543 DelayedTime=0 TotalMemory=4019584 FreeMemory=3549100
I know it can be done in the transform.conf and prop.conf files. I would just use a search command.
Would it be best to break it up using spaces? The order of the data should always be the same.
My final result would be a real time table or graph to monitor, BusyThreads, HandledRequests and FreeMemory.
Help for a newbie.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
did you already indexed this data? cause Splunks default behaviour is that it will extract the key=values pairs (due the = seperator)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
did you already indexed this data? cause Splunks default behaviour is that it will extract the key=values pairs (due the = seperator)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think I've figured it out. This is close to what I need: | search "BusyThreads*" "HandledRequest*"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Make sure you have field discovery turned on when searching?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
right, but you dont have the fieldextractions like Idletreads=21 etc?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes it's indexed.
Join Us for Splunk University and Get Your Bootcamp Game On!
.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!
Announcing Scheduled Export GA for Dashboard Studio
