Dashboards & Visualizations

How to extract data from log file into dashboard?

jwilliams1
Engager

Hi,

Below is an extract of the log data that I'd like to present in my dashboard. The purpose is to get a display of the total additions and total errors for each file - Activity.txt and Activit_XYZ.txt.

11/4/2022 7:30:00 AM Processing Task t1. Searching for D:\Box\FIL\Import\Activity\*.txt
11/4/2022 7:30:00 AM Processing D:\Box\FIL\Import\Activity\Activity.txt
11/4/2022 7:30:00 AM Deleted D:\Box\FIL\Import\Activity\Activity.txt
11/4/2022 7:30:00 AM Total Attempted Add's: 7
11/4/2022 7:30:00 AM Total Additions: 7
11/4/2022 7:30:00 AM Total Errors during Add: 0
11/4/2022 7:30:00 AM Last Transaction: 0
11/4/2022 7:30:00 AM Processing D:\Box\FIL\Import\Activity\Activity_XYZ.txt
11/4/2022 7:30:00 AM Deleted D:\Box\FIL\Import\Activity\Activity_XYZ.txt
11/4/2022 7:30:00 AM Total Attempted Add's: 17
11/4/2022 7:30:00 AM Total Additions: 17
11/4/2022 7:30:00 AM Total Errors during Add: 0
11/4/2022 7:30:00 AM Last Transaction: 0

I've created a script but this only displays the first instance of Total Additions and Total Errors, could you help me to display the second instance of the data.

To display Total Additions I use the script below;

host="VMXXX12" source="D:\\Box\\FIL\\Logs\\Pbsa\\Import Activity.log" "Total Additions: " | rex "Total Additions: \s*(?<Total_Additions>.+)\s*" | fields Total_Additions | head 1 | eval range=if(Total_Additions=="0", "severe", "low")

To display Total Errors I use the script below;

host="VMXXX12" source="D:\\Box\\FIL\\Logs\\Pbsa\\Import Activity.log" "Total Errors during Add: " | rex "Total Errors during Add: \s*(?<Total_Error>.+)\s*" | fields Total_Error | head 1 | eval range=if(Total_Error=="0", "low", "severe")

Thanks!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer
SplunkTrust
SplunkTrust

Try head 2

jwilliams1
Engager

Thank you, that worked!

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...