Dashboards & Visualizations

How to create a dashboard with metrics for all variables in my sample data if everything is extracted in one field?

krishnacasso
Path Finder

[30706/3663031152][Thu Aug 21 2016 13:15:02][CServer.cpp:4719][INFO][sm-Server-000000] Thread pool: Msgs=6287903 Waits=5960219 Misses=11921129 Max HP Msg=7 Max NP Msg=28 Current Depth=0 Max Depth=28 Current High Depth=0 Current Norm Depth=0 Current Threads=16 Max Threads=16 Busy Threads=0

All the highlighted context will be coming under field extraction txn.
How can we create a dashboard metric for all the variables if every thing comes under one field?

0 Karma

JDukeSplunk
Builder

So, using the field extractor you can generate an inline regex for it and get something like this.

  index=whatever sourcetype=whatever (basesearch) 
 |rex field=_raw "^[^=\n]*=(?P[^ ]+) Waits=(?P[^ ]+)\s+\w+=(?P\d+)[^=\n]*=(?P[^ ]+)\s+(\w+\s+)+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)"

 |(stats or timechart or table or whatever you want to do with it.)

I got it to work with your sample. As shown.

alt text

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...