How to extract fields with same name for visualization?

cpramuk — Tue, 05 Apr 2022 15:16:44 GMT

I'm trying to extract and dashboard the latest number in my logs for each "7d" stat.

Some sample logs:

[db]: 00:05:01.000: 3ddesigns:total 173304125

[db]: 00:05:01.000: 3ddesigns:1d 253113

[db]: 00:05:01.000: 3ddesigns:7d 1435675

[db]: 00:05:01.000: 3ddesigns:30d 5863610

[db]: 00:05:01.000: 3dlessons:total 92148058

[db]: 00:05:01.000: 3dlessons:1d 103077

[db]: 00:05:01.000: 3dlessons:7d 539695

[db]: 00:05:01.000: 3dlessons:30d 2216809

[db]: 00:05:01.000: circuitsdesigns:total 62150103

[db]: 00:05:01.000: circuitsdesigns:1d 125770

[db]: 00:05:01.000: circuitsdesigns:7d 724227

[db]: 00:05:01.000: circuitsdesigns:30d 2936667

I have a search query but it gives me a Null field...is there a way to rename the fields?:

obs_mnkr="tnkrcad-p-ue1" source="/disk/logtxt/stats.log" 
| multikv noheader=t 
| fields _raw 
| rex "3ddesigns:(?<designs>\w+)\s+(?<num>\d+)"
| regex designs!="1d" 
| regex designs!="30d" 
| regex designs!="total" 
| rex "circuitsdesigns:(?<circuits>\w+)\s+(?<num>\d+)"
| regex circuits!="1d" 
| regex circuits!="30d" 
| regex circuits!="total" 
| timechart span=1w last(num) by designs

Re: Extracting fields with same name for visualization

bowesmana — Tue, 05 Apr 2022 05:28:07 GMT

Not clear what your expected output is, but is this what you are looking for

Re: How to extract fields with same name for visualization?

cpramuk — Tue, 05 Apr 2022 16:57:36 GMT

Thank you!!...I was missing the "search 7d" in all of my trials....

topic Re: How to extract fields with same name for visualization? in Dashboards & Visualizations

How to extract fields with same name for visualization?

Re: Extracting fields with same name for visualization

Re: How to extract fields with same name for visualization?