Display data in a tabular format

sajug — Sat, 06 Jul 2019 01:09:59 GMT

I am looking for some help in getting the logs formatted in a tabular format

I have these in the logs getting printed every 5 minutes

07-06-19:00:40, eventtype=ping, rsptime=0.190, srvname=srv1, srvip=xxx.xxx.xxx.01
07-06-19:00:40, eventtype=ping, rsptime=0.201, srvname=srv2, srvip=xxx.xxx.xxx.02
07-06-19:00:40, eventtype=ping, rsptime=16.991, srvname=srv3, srvip=xxx.xxx.xxx.03
07-06-19:00:40, eventtype=ping, rsptime=17.000, srvname=srv4, srvip=xxx.xxx.xxx.04

07-06-19:05:40, eventtype=ping, rsptime=0.190, srvname=srv1, srvip=xxx.xxx.xxx.01
07-06-19:00:40, eventtype=ping, rsptime=0.201, srvname=srv2, srvip=xxx.xxx.xxx.02
07-06-19:05:40, eventtype=ping, rsptime=16.991, srvname=srv3, srvip=xxx.xxx.xxx.03
07-06-19:05:40, eventtype=ping, rsptime=17.000, srvname=srv4, srvip=xxx.xxx.xxx.04

I want the above data to presented in the below format

         srv1|srv2|srv3|srv4

07-06-19:00 0.190 | 0.201 | 0.201 | 16.991 | 17.000
07-06-19:05 0.190 | 0.201 | 0.201 | 16.991 | 17.000

First row/column heading is going to be the server name
Rows will print the rsptime

Re: Display data in a tabular format

woodcock — Sat, 06 Jul 2019 03:00:19 GMT

You asked for this:

index=<You Should Always Specify An index> AND sourcetype=<And sourcetpye Too>
| table _time rsptime srvname
| xyseries _time srvname rsptime

But you probably need is something like this:

index=<You Should Always Specify An index> AND sourcetype=<And sourcetpye Too>
| timechart span=15m avg(rsptime) BY srvname

Re: Display data in a tabular format

sajug — Tue, 09 Jul 2019 16:26:11 GMT

Actually your first query worked for me. Thank you Woodcock

topic Re: Display data in a tabular format in Dashboards & Visualizations

Display data in a tabular format

Re: Display data in a tabular format

Re: Display data in a tabular format