Parse Results in charting

[anshu2812]

Hi,

I have a console application on the forwarder which monitors the services running on that machine and forwards the responses to the indexer in the following format -

HostName=Host1, Status=Running
HostName=Host2, Status=Running
HostName=Host3, Status=Stopped
HostName=Host4, Status=Stopped

Following are the 2 questions I have -
1. I want to show the response in a table format with HostName and Status. I am just getting the 1st value Host1 always in the table rest values are not populating on the chart even if I search by just sourcetype. Can someone please tell me how to parse the field so that I get all the HostName.
2. Based on the status "Running" or "Stopped" I want to show an image on the chart, is it possible? If yes, then how can I do it, please suggest.

Please note I plan to present the above scenario in views.

[woodcock]

Like this:

| dedup Hostname | table Hostname Status

If your linebreaking is not working (which I think is what you are saying) then while you are working on fixing that, this should work:

| rex max_match=0 field=raw "(?<lineData>HostName.*?Status=\w+)" | mvexpand lineData | rex field=lineData "HostName=(?<HostName>=[^,].*?Status=(?<Status>.*)"

Then you can replace the Status with an Icon like this:

http://blogs.splunk.com/2014/03/17/custom-icons-in-splunk-6-tables/