Dashboards & Visualizations

How to create a dashboard with metrics for all variables in my sample data if everything is extracted in one field?

krishnacasso
Path Finder

[30706/3663031152][Thu Aug 21 2016 13:15:02][CServer.cpp:4719][INFO][sm-Server-000000] Thread pool: Msgs=6287903 Waits=5960219 Misses=11921129 Max HP Msg=7 Max NP Msg=28 Current Depth=0 Max Depth=28 Current High Depth=0 Current Norm Depth=0 Current Threads=16 Max Threads=16 Busy Threads=0

All the highlighted context will be coming under field extraction txn.
How can we create a dashboard metric for all the variables if every thing comes under one field?

0 Karma

JDukeSplunk
Builder

So, using the field extractor you can generate an inline regex for it and get something like this.

  index=whatever sourcetype=whatever (basesearch) 
 |rex field=_raw "^[^=\n]*=(?P[^ ]+) Waits=(?P[^ ]+)\s+\w+=(?P\d+)[^=\n]*=(?P[^ ]+)\s+(\w+\s+)+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)"

 |(stats or timechart or table or whatever you want to do with it.)

I got it to work with your sample. As shown.

alt text

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...