Dashboards & Visualizations

How do I configure Splunk to extract fields for data coming in via scripted into to produce a table on a dashboard?

muellernc
Engager

Dear Splunk-Community,

I loaded Hadoop events in the Following format into Splunk:
alt text

In the next step I would like to create a dashboard which displays those values in a table, something like this:

alt text

and so on.

I am stuck because Splunk won't recognize those event lines as searchable fields. Any ideas on how I can generate the table from the sample event?

Thanks in advance!

0 Karma

sundareshr
Legend

If you are comfortable change transforms.conf & props.conf, you will need to add a field extraction rule to extract these fields at searchtime. Something like this in your transforms should do it

[your stanza]
REGEX = ([^:]+):(.*)
FORMAT = $1::$2

The other option is to achieve this from web ui (this may be easier with similar results). Here's a link on that http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Managefieldtransforms

Third option, is use the extract command in your search, like this

... | extract pairdelim="\n" kvdelim=":"

This would be my last option.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...