Break script output into top values on multi value keys

scalexan62 — Wed, 11 Jan 2012 14:35:37 GMT

I have a script that produces output like the following:

foo=abc, bar=efg, size=100
foo=abc, bar=kkk, size=102
foo=cba, bar=fff, size=110
foo=cba, bar=ppp, size=90
foo=aaa, bar=bbb, size=95

I like to now get a chart showing the top values something like this:

foo/bar                size
-------                ----
cba/fff                110
abc/kkk                102
abc/efg                100
aaa/bbb                 95
cba/ppp                 90

Any suggestions. Do I need to break this up into separate events?

Re: Break script output into top values on multi value keys

sbrant_tt — Sat, 14 Jan 2012 01:31:26 GMT

I think this will work for you:

 | multikv noheader=t | rex field=Column_1 "foo=(?<foo>.*)" | rex field=Column_2 "bar=(?<bar>.*)" | rex field=Column_3 "size=(?<size>.*)" | eval "foo/bar"=foo."/".bar | top size by foo/bar showcount=f showperc=f

topic Break script output into top values on multi value keys in Getting Data In

Break script output into top values on multi value keys

Re: Break script output into top values on multi value keys