Dashboards & Visualizations

How to extract data from log file into dashboard?

jwilliams1
Engager

Hi,

Below is an extract of the log data that I'd like to present in my dashboard. The purpose is to get a display of the total additions and total errors for each file - Activity.txt and Activit_XYZ.txt.

11/4/2022 7:30:00 AM Processing Task t1. Searching for D:\Box\FIL\Import\Activity\*.txt
11/4/2022 7:30:00 AM Processing D:\Box\FIL\Import\Activity\Activity.txt
11/4/2022 7:30:00 AM Deleted D:\Box\FIL\Import\Activity\Activity.txt
11/4/2022 7:30:00 AM Total Attempted Add's: 7
11/4/2022 7:30:00 AM Total Additions: 7
11/4/2022 7:30:00 AM Total Errors during Add: 0
11/4/2022 7:30:00 AM Last Transaction: 0
11/4/2022 7:30:00 AM Processing D:\Box\FIL\Import\Activity\Activity_XYZ.txt
11/4/2022 7:30:00 AM Deleted D:\Box\FIL\Import\Activity\Activity_XYZ.txt
11/4/2022 7:30:00 AM Total Attempted Add's: 17
11/4/2022 7:30:00 AM Total Additions: 17
11/4/2022 7:30:00 AM Total Errors during Add: 0
11/4/2022 7:30:00 AM Last Transaction: 0

I've created a script but this only displays the first instance of Total Additions and Total Errors, could you help me to display the second instance of the data.

To display Total Additions I use the script below;

host="VMXXX12" source="D:\\Box\\FIL\\Logs\\Pbsa\\Import Activity.log" "Total Additions: " | rex "Total Additions: \s*(?<Total_Additions>.+)\s*" | fields Total_Additions | head 1 | eval range=if(Total_Additions=="0", "severe", "low")

To display Total Errors I use the script below;

host="VMXXX12" source="D:\\Box\\FIL\\Logs\\Pbsa\\Import Activity.log" "Total Errors during Add: " | rex "Total Errors during Add: \s*(?<Total_Error>.+)\s*" | fields Total_Error | head 1 | eval range=if(Total_Error=="0", "low", "severe")

Thanks!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer
SplunkTrust
SplunkTrust

Try head 2

jwilliams1
Engager

Thank you, that worked!

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...