topic Re: how can I format and chart a status message? in Splunk Search

how can I format and chart a status message?

msantich — Wed, 03 Aug 2016 15:50:06 GMT

Hello,
a device in our system returns a status message that looks like the following (as seen in splunk search results)

state (UP | DN| STDBY | UNK); parma: (string) , parmb:(int), etc

notice that there is no delimiter between "state" and the value of state
notice also that some parameters have integer values and some are strings. most of the parameters that are strings are limited to true/false, or up/down, etc.....

I'd like to have a realtime chart/display that is updated once/interval I choose.

for the parameters that have string values, it's OK to translate those to a numerical or color representation for display

I'm trying to read and understand how to use the chart command, but I'm having a hard time translating the "syntax" descriptions to "real life"....

I'd appreciate some help getting started on my learning curve.

thanks so much

Re: how can I format and chart a status message?

richgalloway — Wed, 03 Aug 2016 16:30:39 GMT

Some example data would be useful. Is "state" and its value separated by a space or is there no separation?

What exactly are you wanting to graph?

Re: how can I format and chart a status message?

somesoni2 — Wed, 03 Aug 2016 16:32:07 GMT

Can we have some mock expected output and some real sample events?

Re: how can I format and chart a status message?

Runals — Wed, 03 Aug 2016 16:41:04 GMT

From your description it doesn't seem like the fields have been defined in your data. As richgalloway mentioned having some more sample data would help. Assuming there is a space between state and state value and just going with parameter A where that is really parama you could try something like this I suppose.

... | rex "state "(?<state>\S)" | rex "parama: (?<parama>.+)\s," | chart count over state by parama

Re: how can I format and chart a status message?

msantich — Wed, 03 Aug 2016 17:02:35 GMT

Thank you. here is an excerpt from specific event
state SYNCED; deltatime: 57, datamoving: true, outcount: 50

this status event is provided once/second and I'd like a moving guage/bar, etc that responds to deltaTime and another moving guage/bar that responds to outcount, and perhaps set a "redline" with an alert that triggers when a value exceeds the redline...

Thank you very much.

Re: how can I format and chart a status message?

msantich — Wed, 03 Aug 2016 17:03:05 GMT

Thank you. here is an excerpt from specific event
state SYNCED; deltatime: 57, datamoving: true, outcount: 50

Thank you very much.

Re: how can I format and chart a status message?

msantich — Wed, 03 Aug 2016 17:03:44 GMT

Thank you. here is an excerpt from specific event
state SYNCED; deltatime: 57, datamoving: true, outcount: 50

Thank you very much.

Re: how can I format and chart a status message?

msantich — Wed, 03 Aug 2016 17:03:51 GMT

Thank you. here is an excerpt from specific event
state SYNCED; deltatime: 57, datamoving: true, outcount: 50

Thank you very much.

Re: how can I format and chart a status message?

msantich — Wed, 03 Aug 2016 18:18:35 GMT

Thanks all,
between your suggestions and finding splunk app will do most of this work for me, I'm seeing some light....

thanks for the quick feedback

have a great day.