Dashboards & Visualizations

How to extract data from log file into dashboard?

jwilliams1
Engager

Hi,

Below is an extract of the log data that I'd like to present in my dashboard. The purpose is to get a display of the total additions and total errors for each file - Activity.txt and Activit_XYZ.txt.

11/4/2022 7:30:00 AM Processing Task t1. Searching for D:\Box\FIL\Import\Activity\*.txt
11/4/2022 7:30:00 AM Processing D:\Box\FIL\Import\Activity\Activity.txt
11/4/2022 7:30:00 AM Deleted D:\Box\FIL\Import\Activity\Activity.txt
11/4/2022 7:30:00 AM Total Attempted Add's: 7
11/4/2022 7:30:00 AM Total Additions: 7
11/4/2022 7:30:00 AM Total Errors during Add: 0
11/4/2022 7:30:00 AM Last Transaction: 0
11/4/2022 7:30:00 AM Processing D:\Box\FIL\Import\Activity\Activity_XYZ.txt
11/4/2022 7:30:00 AM Deleted D:\Box\FIL\Import\Activity\Activity_XYZ.txt
11/4/2022 7:30:00 AM Total Attempted Add's: 17
11/4/2022 7:30:00 AM Total Additions: 17
11/4/2022 7:30:00 AM Total Errors during Add: 0
11/4/2022 7:30:00 AM Last Transaction: 0

I've created a script but this only displays the first instance of Total Additions and Total Errors, could you help me to display the second instance of the data.

To display Total Additions I use the script below;

host="VMXXX12" source="D:\\Box\\FIL\\Logs\\Pbsa\\Import Activity.log" "Total Additions: " | rex "Total Additions: \s*(?<Total_Additions>.+)\s*" | fields Total_Additions | head 1 | eval range=if(Total_Additions=="0", "severe", "low")

To display Total Errors I use the script below;

host="VMXXX12" source="D:\\Box\\FIL\\Logs\\Pbsa\\Import Activity.log" "Total Errors during Add: " | rex "Total Errors during Add: \s*(?<Total_Error>.+)\s*" | fields Total_Error | head 1 | eval range=if(Total_Error=="0", "low", "severe")

Thanks!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer
SplunkTrust
SplunkTrust

Try head 2

jwilliams1
Engager

Thank you, that worked!

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...