topic Re: charting raw data in Dashboards & Visualizations

charting raw data

jossaq — Wed, 15 Aug 2012 19:07:32 GMT

I have a raw entries like this:

[08/14/12 09:58:55] SNMP INFO request  received from 10.25.6.227  with unknown community string cable-d

the word after "string" varies form log to log.

I want to search something like this

... | chart count(word_after_"string") by host,word_after_string

How can I do that?

Reggards

Re: charting raw data

Ayn — Wed, 15 Aug 2012 19:12:17 GMT

... | rex "unknown community string (?<community_string>\S+)" | chart count by host,community_string

Re: charting raw data

tfletcher_splun — Wed, 15 Aug 2012 19:14:16 GMT

You need to do a field extraction. Best choice is probably the rex command, though if you do this frequently you probably want to make it an automatic extraction in props.conf

... | rex field=_raw "string\w+(?<word_after_string>.*)$" | chart count by host, word_after_string

That should get you started, more details at:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex