Dashboards & Visualizations

I have a field whose value is multiple words having spaces, how do I show the whole value in table?

cadrija
Path Finder

I am getting this data when I am pulling events from a sourcetype

Name=Microsoft Hyper-V Network Adapter _2

Now I want to show this in a table, but when I am using --> table Name then it is showing only Microsoft i.e. only the first word is being shown.

How can I show the whole value of the name field?
Please help.

 

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

Try this....

 

 

 

 

| makeresults 
| eval _raw= "BytesReceivedPersec=5057
BytesSentPersec=12654
BytesTotalPersec=17711
CurrentBandwidth=50000000000
Name=Microsoft Hyper-V Network Adapter _2
wmi_type=LocalNetwork"
| rex field=_raw "Name\=(?<Name>[\w\s\-\_]+)\s"
| table Name

 

Gr0und_Z3r0_1-1638446830325.png

 

0 Karma

Gr0und_Z3r0
Contributor

Can you share a sample raw data?

 

0 Karma

cadrija
Path Finder

BytesReceivedPersec=5057
BytesSentPersec=12654
BytesTotalPersec=17711
CurrentBandwidth=50000000000
Name=Microsoft Hyper-V Network Adapter _2
wmi_type=LocalNetwork

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...