Dashboards & Visualizations

How to create a dashboard with metrics for all variables in my sample data if everything is extracted in one field?

krishnacasso
Path Finder

[30706/3663031152][Thu Aug 21 2016 13:15:02][CServer.cpp:4719][INFO][sm-Server-000000] Thread pool: Msgs=6287903 Waits=5960219 Misses=11921129 Max HP Msg=7 Max NP Msg=28 Current Depth=0 Max Depth=28 Current High Depth=0 Current Norm Depth=0 Current Threads=16 Max Threads=16 Busy Threads=0

All the highlighted context will be coming under field extraction txn.
How can we create a dashboard metric for all the variables if every thing comes under one field?

0 Karma

JDukeSplunk
Builder

So, using the field extractor you can generate an inline regex for it and get something like this.

  index=whatever sourcetype=whatever (basesearch) 
 |rex field=_raw "^[^=\n]*=(?P[^ ]+) Waits=(?P[^ ]+)\s+\w+=(?P\d+)[^=\n]*=(?P[^ ]+)\s+(\w+\s+)+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)"

 |(stats or timechart or table or whatever you want to do with it.)

I got it to work with your sample. As shown.

alt text

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...