https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-when-required-fields-are-not-present/m-p/189220#M54523 <P>hi moiezuddin,</P> <P>it is necessary to extract these fields using regular expressions before achieving dashboards using these fields. And for that you need to identify in your data the values corresponding to each field you need.<BR /> eg extraction of the field at random from your data: <BR /> <CODE>source="dashboard_field.csv" host="student09-PC" index="field" sourcetype="csv" |rex "^[^'\n]*'(?P\w+'\))" |table type</CODE></P> <P>this allows to retrieve the values of a certain type field that I choose.<BR /> try this and let me know if it works. or or you send me the file with which you work at <CODE>gyslainko@gmail.com</CODE>, and I'll help you extract these fields and then send you the regular expressions that you will use to work with.</P> <P>please forgive my english. after</P> Thu, 19 Mar 2015 10:07:26 GMT gyslainlatsa 2015-03-19T10:07:26Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-when-required-fields-are-not-present/m-p/189219#M54522 <P>I have a source="/opt/www/logs</P> <P>i need the fields <CODE>jobTitle</CODE>, <CODE>orgName</CODE>, <CODE>orgSegment</CODE>, <CODE>parentOrgname</CODE>, and <CODE>userType</CODE></P> <P>Can anyone help provide the search?</P> Thu, 19 Mar 2015 07:19:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-when-required-fields-are-not-present/m-p/189219#M54522 moiezuddin 2015-03-19T07:19:40Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-when-required-fields-are-not-present/m-p/189220#M54523 <P>hi moiezuddin,</P> <P>it is necessary to extract these fields using regular expressions before achieving dashboards using these fields. And for that you need to identify in your data the values corresponding to each field you need.<BR /> eg extraction of the field at random from your data: <BR /> <CODE>source="dashboard_field.csv" host="student09-PC" index="field" sourcetype="csv" |rex "^[^'\n]*'(?P\w+'\))" |table type</CODE></P> <P>this allows to retrieve the values of a certain type field that I choose.<BR /> try this and let me know if it works. or or you send me the file with which you work at <CODE>gyslainko@gmail.com</CODE>, and I'll help you extract these fields and then send you the regular expressions that you will use to work with.</P> <P>please forgive my english. after</P> Thu, 19 Mar 2015 10:07:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-when-required-fields-are-not-present/m-p/189220#M54523 gyslainlatsa 2015-03-19T10:07:26Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-when-required-fields-are-not-present/m-p/189221#M54524 <P>Hi<BR /> If the file contain these fields <BR /> try like this </P> <PRE><CODE>source="/opt/www/logs" | table jobTitle orgName orgSegment parentOrgname userType </CODE></PRE> Fri, 20 Mar 2015 12:27:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-when-required-fields-are-not-present/m-p/189221#M54524 chimell 2015-03-20T12:27:45Z