Dashboards & Visualizations

How to create a dashboard with metrics for all variables in my sample data if everything is extracted in one field?

krishnacasso
Path Finder

[30706/3663031152][Thu Aug 21 2016 13:15:02][CServer.cpp:4719][INFO][sm-Server-000000] Thread pool: Msgs=6287903 Waits=5960219 Misses=11921129 Max HP Msg=7 Max NP Msg=28 Current Depth=0 Max Depth=28 Current High Depth=0 Current Norm Depth=0 Current Threads=16 Max Threads=16 Busy Threads=0

All the highlighted context will be coming under field extraction txn.
How can we create a dashboard metric for all the variables if every thing comes under one field?

0 Karma

JDukeSplunk
Builder

So, using the field extractor you can generate an inline regex for it and get something like this.

  index=whatever sourcetype=whatever (basesearch) 
 |rex field=_raw "^[^=\n]*=(?P[^ ]+) Waits=(?P[^ ]+)\s+\w+=(?P\d+)[^=\n]*=(?P[^ ]+)\s+(\w+\s+)+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)"

 |(stats or timechart or table or whatever you want to do with it.)

I got it to work with your sample. As shown.

alt text

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...