Dashboards & Visualizations

How to extract data from log file into dashboard?

jwilliams1
Engager

Hi,

Below is an extract of the log data that I'd like to present in my dashboard. The purpose is to get a display of the total additions and total errors for each file - Activity.txt and Activit_XYZ.txt.

11/4/2022 7:30:00 AM Processing Task t1. Searching for D:\Box\FIL\Import\Activity\*.txt
11/4/2022 7:30:00 AM Processing D:\Box\FIL\Import\Activity\Activity.txt
11/4/2022 7:30:00 AM Deleted D:\Box\FIL\Import\Activity\Activity.txt
11/4/2022 7:30:00 AM Total Attempted Add's: 7
11/4/2022 7:30:00 AM Total Additions: 7
11/4/2022 7:30:00 AM Total Errors during Add: 0
11/4/2022 7:30:00 AM Last Transaction: 0
11/4/2022 7:30:00 AM Processing D:\Box\FIL\Import\Activity\Activity_XYZ.txt
11/4/2022 7:30:00 AM Deleted D:\Box\FIL\Import\Activity\Activity_XYZ.txt
11/4/2022 7:30:00 AM Total Attempted Add's: 17
11/4/2022 7:30:00 AM Total Additions: 17
11/4/2022 7:30:00 AM Total Errors during Add: 0
11/4/2022 7:30:00 AM Last Transaction: 0

I've created a script but this only displays the first instance of Total Additions and Total Errors, could you help me to display the second instance of the data.

To display Total Additions I use the script below;

host="VMXXX12" source="D:\\Box\\FIL\\Logs\\Pbsa\\Import Activity.log" "Total Additions: " | rex "Total Additions: \s*(?<Total_Additions>.+)\s*" | fields Total_Additions | head 1 | eval range=if(Total_Additions=="0", "severe", "low")

To display Total Errors I use the script below;

host="VMXXX12" source="D:\\Box\\FIL\\Logs\\Pbsa\\Import Activity.log" "Total Errors during Add: " | rex "Total Errors during Add: \s*(?<Total_Error>.+)\s*" | fields Total_Error | head 1 | eval range=if(Total_Error=="0", "low", "severe")

Thanks!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer
SplunkTrust
SplunkTrust

Try head 2

jwilliams1
Engager

Thank you, that worked!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...