Dashboards & Visualizations

Get specific values by providing key

thewho123
Explorer

I have a lot of lines in the following format:

CPU: 2.7GHz, 2, 'Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz', OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: 'HP EliteBook Folio 9480m', 'Hewlett-Packard'

I get this list with: "CPU: earliest=-1h"

I am trying to create a dashboard/graph showing statistics on what OS and CPU customers use mostly.

How do I achieve this?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=foo sourcetype=bar "CPU:" earliest=-1h | rex "CPU:\s+(?<CPU>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"

View solution in original post

Runals
Motivator

You can use somesoni2's rex statement to pull out the fields but then depending on how you want to present the data you could do a simple stats command

... | dedup host | stats count by CPU OS | sort -count

Based on your query I'm guessing the data is generated every hour? Dedup is good though if the data is generated sporadically and you search over a longer period of time there can be more efficient ways to get the most recent data from each system. This also assumes you are saying "showing statistics on what combination OS and CPU customers use mostly"

A good resource to use for making regular expressions is regex101.

somesoni2
Revered Legend

Try something like this

index=foo sourcetype=bar "CPU:" earliest=-1h | rex "CPU:\s+(?<CPU>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"

thewho123
Explorer

Thanks. One more question: What would I need to add to the rex string to get RAM if I have a log like this:

CPU: 2.5GHz, 2, 'Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz', RAM(total): 7879MB, RAM(free): 3738MB, OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: '20AN0069US', 'LENOVO'

I would be interested in RAM(total) and RAM(free)

0 Karma

somesoni2
Revered Legend

The regex is created in the same order they appear in the data, so for your sample logs, the rex command will be like this

| rex "CPU:\s+(?<CPU>.+),\s+RAM\(total\):\s+(?<RAM_total>.+),\s+RAM\(free\):\s+(?<RAM_free>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...