Hi,
I have a console application on the forwarder which monitors the services running on that machine and forwards the responses to the indexer in the following format -
HostName=Host1, Status=Running
HostName=Host2, Status=Running
HostName=Host3, Status=Stopped
HostName=Host4, Status=Stopped
Following are the 2 questions I have -
1. I want to show the response in a table format with HostName and Status. I am just getting the 1st value Host1 always in the table rest values are not populating on the chart even if I search by just sourcetype. Can someone please tell me how to parse the field so that I get all the HostName.
2. Based on the status "Running" or "Stopped" I want to show an image on the chart, is it possible? If yes, then how can I do it, please suggest.
Please note I plan to present the above scenario in views.
Like this:
| dedup Hostname | table Hostname Status
If your linebreaking
is not working (which I think is what you are saying) then while you are working on fixing that, this should work:
| rex max_match=0 field=raw "(?<lineData>HostName.*?Status=\w+)" | mvexpand lineData | rex field=lineData "HostName=(?<HostName>=[^,].*?Status=(?<Status>.*)"
Then you can replace the Status with an Icon like this:
http://blogs.splunk.com/2014/03/17/custom-icons-in-splunk-6-tables/