Here is a sample of my log:
{
NIC: {
eth2: {
linkSpeedInKbps: 10000000
macAddress: XX:XX:XX:XX:XX:XX
name: eth2
stats: {
network.dropped_received_pkts: 0
network.dropped_transmitted_pkts: 0
network.error_received_pkts: 0
network.error_transmitted_pkts: 0
network.received_pkts: 760176
network.received_rate_kBps: 19842
network.transmitted_pkts: 3140672
network.transmitted_rate_kBps: 143753
}
}
eth3: {
linkSpeedInKbps: 10000000
macAddress: XX:XX:XX:XX:XX:XX
name: eth3
stats: {
network.dropped_received_pkts: 0
network.dropped_transmitted_pkts: 0
network.error_received_pkts: 0
network.error_transmitted_pkts: 0
network.received_pkts: 1068
network.received_rate_kBps: 2
network.transmitted_pkts: 2
network.transmitted_rate_kBps: 0
}
}
}
nodeName: MyServer01
}
I am capturing basic network information on the servers in my environment. I would like to format a dashboard to look something like this:
I can't figure out how to get the chart to format correctly. I have tried the following:
index=mylogs sourcetype=serverstats nodeName=MyServer01
| chart latest("NIC.*.name") as "*",latest("NIC.*.linkSpeedInKbps") as "* Speed", latest("NIC.*.macAddress") as "* MAC Address" by "NIC.*.name"
And I don't get any results.
I am capturing the information and logging it. I can change the format of the log if I need to. Does anyone have any ideas on how I can get this to work?
When I use your top section (where you create the JSON log in Splunk using the "| makeresults" command) everything works as expected. When I use the second solution I get this instead of a table:
There is more in the log than what I initially posted. I kept the rest of it out (so we could focus on the project at hand). What am I missing?
