Dashboards & Visualizations

Parse Results in charting



I have a console application on the forwarder which monitors the services running on that machine and forwards the responses to the indexer in the following format -

HostName=Host1, Status=Running
HostName=Host2, Status=Running
HostName=Host3, Status=Stopped
HostName=Host4, Status=Stopped

Following are the 2 questions I have -
1. I want to show the response in a table format with HostName and Status. I am just getting the 1st value Host1 always in the table rest values are not populating on the chart even if I search by just sourcetype. Can someone please tell me how to parse the field so that I get all the HostName.
2. Based on the status "Running" or "Stopped" I want to show an image on the chart, is it possible? If yes, then how can I do it, please suggest.

Please note I plan to present the above scenario in views.

Tags (1)
0 Karma

Esteemed Legend

Like this:

| dedup Hostname | table Hostname Status

If your linebreaking is not working (which I think is what you are saying) then while you are working on fixing that, this should work:

| rex max_match=0 field=raw "(?<lineData>HostName.*?Status=\w+)" | mvexpand lineData | rex field=lineData "HostName=(?<HostName>=[^,].*?Status=(?<Status>.*)"

Then you can replace the Status with an Icon like this:


0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...