topic Re: Get specific values by providing key in Dashboards & Visualizations

Get specific values by providing key

thewho123 — Fri, 18 Mar 2016 21:45:01 GMT

I have a lot of lines in the following format:

CPU: 2.7GHz, 2, 'Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz', OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: 'HP EliteBook Folio 9480m', 'Hewlett-Packard'

I get this list with: "CPU: earliest=-1h"

I am trying to create a dashboard/graph showing statistics on what OS and CPU customers use mostly.

How do I achieve this?

Re: Get specific values by providing key

somesoni2 — Sat, 19 Mar 2016 18:16:12 GMT

Try something like this

index=foo sourcetype=bar "CPU:" earliest=-1h | rex "CPU:\s+(?<CPU>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"

Re: Get specific values by providing key

Runals — Sat, 19 Mar 2016 20:55:16 GMT

You can use somesoni2's rex statement to pull out the fields but then depending on how you want to present the data you could do a simple stats command

... | dedup host | stats count by CPU OS | sort -count

Based on your query I'm guessing the data is generated every hour? Dedup is good though if the data is generated sporadically and you search over a longer period of time there can be more efficient ways to get the most recent data from each system. This also assumes you are saying "showing statistics on what combination OS and CPU customers use mostly"

A good resource to use for making regular expressions is regex101.

Re: Get specific values by providing key

thewho123 — Wed, 23 Mar 2016 21:25:58 GMT

Thanks. One more question: What would I need to add to the rex string to get RAM if I have a log like this:

CPU: 2.5GHz, 2, 'Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz', RAM(total): 7879MB, RAM(free): 3738MB, OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: '20AN0069US', 'LENOVO'

I would be interested in RAM(total) and RAM(free)

Re: Get specific values by providing key

somesoni2 — Wed, 23 Mar 2016 21:36:55 GMT

The regex is created in the same order they appear in the data, so for your sample logs, the rex command will be like this

| rex "CPU:\s+(?<CPU>.+),\s+RAM\(total\):\s+(?<RAM_total>.+),\s+RAM\(free\):\s+(?<RAM_free>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"