https://community.splunk.com/t5/Splunk-Search/file-manipulation-for-custom-logs/m-p/55382#M13511 <P>I have a custom log file format that i am importing via a windows forwarder. In it there are a number of fields related to configuration items and at the bottom is a summation of all the non-compliant items</P> <PRE><CODE>file=abc&lt;date&gt;.log hostname=abc section1=pass section2=fail section3=pass totalFailed=1 </CODE></PRE> <P>There could be multiple files for the same hostname (havent changed it to ignore non-new files) I would like to have an output that shows the latest file by hostname and the value for the field totalFailed. There will be multiple files from different hostnames and i would like the most recent file from each host to show the line of total failed items.</P> <PRE><CODE>hostA | file | totalFailed </CODE></PRE> <P>As a bonus point, how would i colorize (red) any values of totalFailed if its non-zero? I would eventually like to extend this to a dashboard that shows a single value image of all non-compliant hosts (red&gt;0) and all compliant hosts (green=0). I would imagine i need this to be a parameterized search to return a single value and the hostname to label it. But first things first, I tried using</P> <PRE><CODE> | stats max(file) by hostname </CODE></PRE> <P>but that gets me a count of the files for the latest hostname.</P> <PRE><CODE>| top limit=1 file by hostname </CODE></PRE> <P>gets me the same thing i believe.</P> <P>Any suggestions on how to do this?</P> Tue, 08 Mar 2011 11:05:39 GMT EricPartington 2011-03-08T11:05:39Z https://community.splunk.com/t5/Splunk-Search/file-manipulation-for-custom-logs/m-p/55382#M13511 <P>I have a custom log file format that i am importing via a windows forwarder. In it there are a number of fields related to configuration items and at the bottom is a summation of all the non-compliant items</P> <PRE><CODE>file=abc&lt;date&gt;.log hostname=abc section1=pass section2=fail section3=pass totalFailed=1 </CODE></PRE> <P>There could be multiple files for the same hostname (havent changed it to ignore non-new files) I would like to have an output that shows the latest file by hostname and the value for the field totalFailed. There will be multiple files from different hostnames and i would like the most recent file from each host to show the line of total failed items.</P> <PRE><CODE>hostA | file | totalFailed </CODE></PRE> <P>As a bonus point, how would i colorize (red) any values of totalFailed if its non-zero? I would eventually like to extend this to a dashboard that shows a single value image of all non-compliant hosts (red&gt;0) and all compliant hosts (green=0). I would imagine i need this to be a parameterized search to return a single value and the hostname to label it. But first things first, I tried using</P> <PRE><CODE> | stats max(file) by hostname </CODE></PRE> <P>but that gets me a count of the files for the latest hostname.</P> <PRE><CODE>| top limit=1 file by hostname </CODE></PRE> <P>gets me the same thing i believe.</P> <P>Any suggestions on how to do this?</P> Tue, 08 Mar 2011 11:05:39 GMT https://community.splunk.com/t5/Splunk-Search/file-manipulation-for-custom-logs/m-p/55382#M13511 EricPartington 2011-03-08T11:05:39Z https://community.splunk.com/t5/Splunk-Search/file-manipulation-for-custom-logs/m-p/55383#M13512 <P>An update, I changed this to a monitor and now import then entire file and create my fields and do the magic that way. Problem solved</P> Sun, 13 Mar 2011 00:59:13 GMT https://community.splunk.com/t5/Splunk-Search/file-manipulation-for-custom-logs/m-p/55383#M13512 EricPartington 2011-03-13T00:59:13Z