Dashboards & Visualizations

How do I configure Splunk to extract fields for data coming in via scripted into to produce a table on a dashboard?

muellernc
Engager

Dear Splunk-Community,

I loaded Hadoop events in the Following format into Splunk:
alt text

In the next step I would like to create a dashboard which displays those values in a table, something like this:

alt text

and so on.

I am stuck because Splunk won't recognize those event lines as searchable fields. Any ideas on how I can generate the table from the sample event?

Thanks in advance!

0 Karma

sundareshr
Legend

If you are comfortable change transforms.conf & props.conf, you will need to add a field extraction rule to extract these fields at searchtime. Something like this in your transforms should do it

[your stanza]
REGEX = ([^:]+):(.*)
FORMAT = $1::$2

The other option is to achieve this from web ui (this may be easier with similar results). Here's a link on that http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Managefieldtransforms

Third option, is use the extract command in your search, like this

... | extract pairdelim="\n" kvdelim=":"

This would be my last option.

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...