Dashboards & Visualizations

Get specific values by providing key

thewho123
Explorer

I have a lot of lines in the following format:

CPU: 2.7GHz, 2, 'Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz', OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: 'HP EliteBook Folio 9480m', 'Hewlett-Packard'

I get this list with: "CPU: earliest=-1h"

I am trying to create a dashboard/graph showing statistics on what OS and CPU customers use mostly.

How do I achieve this?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=foo sourcetype=bar "CPU:" earliest=-1h | rex "CPU:\s+(?<CPU>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"

View solution in original post

Runals
Motivator

You can use somesoni2's rex statement to pull out the fields but then depending on how you want to present the data you could do a simple stats command

... | dedup host | stats count by CPU OS | sort -count

Based on your query I'm guessing the data is generated every hour? Dedup is good though if the data is generated sporadically and you search over a longer period of time there can be more efficient ways to get the most recent data from each system. This also assumes you are saying "showing statistics on what combination OS and CPU customers use mostly"

A good resource to use for making regular expressions is regex101.

somesoni2
Revered Legend

Try something like this

index=foo sourcetype=bar "CPU:" earliest=-1h | rex "CPU:\s+(?<CPU>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"

thewho123
Explorer

Thanks. One more question: What would I need to add to the rex string to get RAM if I have a log like this:

CPU: 2.5GHz, 2, 'Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz', RAM(total): 7879MB, RAM(free): 3738MB, OS: 'Microsoft Windows 7 Professional x64 Edition Service Pack 1 (Build 7601)', SYS: '20AN0069US', 'LENOVO'

I would be interested in RAM(total) and RAM(free)

0 Karma

somesoni2
Revered Legend

The regex is created in the same order they appear in the data, so for your sample logs, the rex command will be like this

| rex "CPU:\s+(?<CPU>.+),\s+RAM\(total\):\s+(?<RAM_total>.+),\s+RAM\(free\):\s+(?<RAM_free>.+),\s+OS:\s+(?<OS>.+),\s+SYS:(?<SYS>.+)"
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...