I am looking for some help in getting the logs formatted in a tabular format
I have these in the logs getting printed every 5 minutes
07-06-19:00:40, eventtype=ping, rsptime=0.190, srvname=srv1, srvip=xxx.xxx.xxx.01
07-06-19:00:40, eventtype=ping, rsptime=0.201, srvname=srv2, srvip=xxx.xxx.xxx.02
07-06-19:00:40, eventtype=ping, rsptime=16.991, srvname=srv3, srvip=xxx.xxx.xxx.03
07-06-19:00:40, eventtype=ping, rsptime=17.000, srvname=srv4, srvip=xxx.xxx.xxx.04
07-06-19:05:40, eventtype=ping, rsptime=0.190, srvname=srv1, srvip=xxx.xxx.xxx.01
07-06-19:00:40, eventtype=ping, rsptime=0.201, srvname=srv2, srvip=xxx.xxx.xxx.02
07-06-19:05:40, eventtype=ping, rsptime=16.991, srvname=srv3, srvip=xxx.xxx.xxx.03
07-06-19:05:40, eventtype=ping, rsptime=17.000, srvname=srv4, srvip=xxx.xxx.xxx.04
I want the above data to presented in the below format
srv1|srv2|srv3|srv4
07-06-19:00 0.190 | 0.201 | 0.201 | 16.991 | 17.000
07-06-19:05 0.190 | 0.201 | 0.201 | 16.991 | 17.000
First row/column heading is going to be the server name
Rows will print the rsptime
You asked for this:
index=<You Should Always Specify An index> AND sourcetype=<And sourcetpye Too>
| table _time rsptime srvname
| xyseries _time srvname rsptime
But you probably need is something like this:
index=<You Should Always Specify An index> AND sourcetype=<And sourcetpye Too>
| timechart span=15m avg(rsptime) BY srvname
Actually your first query worked for me. Thank you Woodcock
You asked for this:
index=<You Should Always Specify An index> AND sourcetype=<And sourcetpye Too>
| table _time rsptime srvname
| xyseries _time srvname rsptime
But you probably need is something like this:
index=<You Should Always Specify An index> AND sourcetype=<And sourcetpye Too>
| timechart span=15m avg(rsptime) BY srvname