Dashboards & Visualizations

I have a field whose value is multiple words having spaces, how do I show the whole value in table?

cadrija
Path Finder

I am getting this data when I am pulling events from a sourcetype

Name=Microsoft Hyper-V Network Adapter _2

Now I want to show this in a table, but when I am using --> table Name then it is showing only Microsoft i.e. only the first word is being shown.

How can I show the whole value of the name field?
Please help.

 

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

Try this....

 

 

 

 

| makeresults 
| eval _raw= "BytesReceivedPersec=5057
BytesSentPersec=12654
BytesTotalPersec=17711
CurrentBandwidth=50000000000
Name=Microsoft Hyper-V Network Adapter _2
wmi_type=LocalNetwork"
| rex field=_raw "Name\=(?<Name>[\w\s\-\_]+)\s"
| table Name

 

Gr0und_Z3r0_1-1638446830325.png

 

0 Karma

Gr0und_Z3r0
Contributor

Can you share a sample raw data?

 

0 Karma

cadrija
Path Finder

BytesReceivedPersec=5057
BytesSentPersec=12654
BytesTotalPersec=17711
CurrentBandwidth=50000000000
Name=Microsoft Hyper-V Network Adapter _2
wmi_type=LocalNetwork

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...