topic Collect values from syslog logging in Splunk Search

Collect values from syslog logging

admin_fred — Thu, 25 Oct 2018 11:25:35 GMT

Hello,

I am new to splunk and have the following question. Below is snippet from a syslog logging. I would like to show the value behind (fordblks): in a chart based on _time.

[10-25 06:22:01,010] [freecwmpUTCd main          728] INF (statistics) MEM:1187840  | Total allocated space (uordblks):      997960
[10-25 06:22:01,010] [freecwmpUTCd main          728] INF (statistics) MEM:1187840  | Total free space (fordblks):           189880

I have tried rex and split and mvindex commands but I don't get it to work yet. Could anyone point me in the right direction?

Re: Collect values from syslog logging

renjith_nair — Thu, 25 Oct 2018 13:04:09 GMT

@admin_fred
Below should give you the value for fordblks and then you can chart.

|rex field=_raw "fordblks\):\s+(?<MY_VALUE>\d+)"

Re: Collect values from syslog logging

admin_fred — Tue, 29 Sep 2020 21:48:14 GMT

Thank you very much!

The code below works fine.

|rex field=_raw "fordblks):\s+(?\d+)" | table _time MY_VALUE

How can I now present information in a chart instead of table?

Re: Collect values from syslog logging

renjith_nair — Tue, 29 Sep 2020 21:45:33 GMT

@admin_fred,
If you have different values for time, then fields _time,MY_VALUE itself could be visualized in a graph.
Or stats values(MY_VALUE) by _time or chart max(MY_VALUE) by _time depends on your requirement.

Re: Collect values from syslog logging

admin_fred — Fri, 26 Oct 2018 14:07:33 GMT

The code below is working as expected:

my search |rex field=_raw "fordblks):\s+(?\d+)" | stats values(MY_VALUE) by  _time my_process

note: my_process is an additional field so the statistics for 'fordblks' will be spitted up for multiple processes, which is very nice addition.

I only notice the search updates (live search) can take quite long. Maybe due to my (slow) Intel Celeron processor.