Dashboards & Visualizations

How to create a dashboard with metrics for all variables in my sample data if everything is extracted in one field?

krishnacasso
Path Finder

[30706/3663031152][Thu Aug 21 2016 13:15:02][CServer.cpp:4719][INFO][sm-Server-000000] Thread pool: Msgs=6287903 Waits=5960219 Misses=11921129 Max HP Msg=7 Max NP Msg=28 Current Depth=0 Max Depth=28 Current High Depth=0 Current Norm Depth=0 Current Threads=16 Max Threads=16 Busy Threads=0

All the highlighted context will be coming under field extraction txn.
How can we create a dashboard metric for all the variables if every thing comes under one field?

0 Karma

JDukeSplunk
Builder

So, using the field extractor you can generate an inline regex for it and get something like this.

  index=whatever sourcetype=whatever (basesearch) 
 |rex field=_raw "^[^=\n]*=(?P[^ ]+) Waits=(?P[^ ]+)\s+\w+=(?P\d+)[^=\n]*=(?P[^ ]+)\s+(\w+\s+)+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P[^ ]+)\s+\w+\s+\w+=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)[^=\n]*=(?P\d+)"

 |(stats or timechart or table or whatever you want to do with it.)

I got it to work with your sample. As shown.

alt text

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...