Hey everyone. I have a data source which contains license usage information.
Each source contains a line like this:
Group License: 10 of 123453 used.
I am capturing these using a regex, as shown below. I want to use a marker gauge to show this data on a dashboard. However when I try to do this, the gauge tops out at 100. Since the number can vary (the licenses are based on a number of feature licenses, so the amount can vary) I can't hardcode the intervals of the gauge. Is there any way to override this behavior? The wiki page for gauges is basically barren.
sourcetype="AS_LICENSE_FILE" host=as1.commercial.mylab.net
| rex "(?i)Key: Group.*? \- (?P<GROUP_LICENSE_USED>\d+)(?= )"
| rex "(?i)Key: Gr.+ of (?P<GROUP_LICENSE_AVAIL>\d+)"
|gauge GROUP_LICENSE_USED GROUP_LICENSE_AVAIL
sourcetype="AS_LICENSE_FILE" host=as1.mylab.net
| rex "(?i)Key: Group.*? \- (?P<GROUP_LICENSE_USED>\d+)(?= )"
| rex "(?i)Key: Gr.+ of (?P<GROUP_LICENSE_AVAIL>\d+)"
|eval p1=round(GROUP_LICENSE_AVAIL/3)
|eval p2=round(p1*2)
|gauge GROUP_LICENSE_USED 0 p1 p2 GROUP_LICENSE_AVAIL
I resolved this by changing it as shown above. Apparently you have to set all of the data points automatically? Is this correct?
sourcetype="AS_LICENSE_FILE" host=as1.mylab.net
| rex "(?i)Key: Group.*? \- (?P<GROUP_LICENSE_USED>\d+)(?= )"
| rex "(?i)Key: Gr.+ of (?P<GROUP_LICENSE_AVAIL>\d+)"
|eval p1=round(GROUP_LICENSE_AVAIL/3)
|eval p2=round(p1*2)
|gauge GROUP_LICENSE_USED 0 p1 p2 GROUP_LICENSE_AVAIL
I resolved this by changing it as shown above. Apparently you have to set all of the data points automatically? Is this correct?