Dashboards & Visualizations

Parse Results in charting

anshu2812
Explorer

Hi,

I have a console application on the forwarder which monitors the services running on that machine and forwards the responses to the indexer in the following format -

HostName=Host1, Status=Running
HostName=Host2, Status=Running
HostName=Host3, Status=Stopped
HostName=Host4, Status=Stopped

Following are the 2 questions I have -
1. I want to show the response in a table format with HostName and Status. I am just getting the 1st value Host1 always in the table rest values are not populating on the chart even if I search by just sourcetype. Can someone please tell me how to parse the field so that I get all the HostName.
2. Based on the status "Running" or "Stopped" I want to show an image on the chart, is it possible? If yes, then how can I do it, please suggest.

Please note I plan to present the above scenario in views.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

| dedup Hostname | table Hostname Status

If your linebreaking is not working (which I think is what you are saying) then while you are working on fixing that, this should work:

| rex max_match=0 field=raw "(?<lineData>HostName.*?Status=\w+)" | mvexpand lineData | rex field=lineData "HostName=(?<HostName>=[^,].*?Status=(?<Status>.*)"

Then you can replace the Status with an Icon like this:

http://blogs.splunk.com/2014/03/17/custom-icons-in-splunk-6-tables/

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...