Parsing logs of multiple types for visualizing in Dashboard

[cpramuk]

I hope you can help me with a dashboard line  visualization I’m trying to make.

Here is an example of our logs, which keep count at the end of each line :
[db]: 00:05:01.000: newcoteachers:1d 115

[db]: 00:05:01.000: newcoteachers:7d 528

[db]: 00:05:01.000: newcoteachers:30d 1884

How can I chart three lines graph in one splunk dashboard panel to represent these numbers? I feel like I'm close but I've hit a wall and cannot find any documentation to help.

The query below only returns the “1d” type. Is it possible to chart the three types?

rex field=_raw  "newteachers:(?<type>.*) (?<num>.*)"  | chart last(num) by type

Thanks for any help

Christian

[isoutamo]

Hi

you can do it this way

| makeresults 
| eval _raw = "[db]: 00:05:01.000: newcoteachers:1d 115
[db]: 00:05:01.000: newcoteachers:7d 528
[db]: 00:05:01.000: newcoteachers:30d 1884" 
| multikv noheader=t 
| fields _raw 
| rex "newcoteachers:(?<type>\w+)\s+(?<num>\d+)" 
| chart last(num) by type

r. Ismo 

[cpramuk · Accepted solution]

That is so great, thank you for helping me!! 

While I have your attention. How can I exclude a type from the query, such as "total", and only dashboard the other 3 types

[db]: 00:05:01.000: newcoteachers:1d 115

[db]: 00:05:01.000: newcoteachers:7d 528

[db]: 00:05:01.000: newcoteachers:30d 1884

[db]: 00:05:01.000: newcoteachers:total 1884

I owe you a pizza! Thanks!

[isoutamo]

Nice to help you.
You should look regex and where command on this page https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

[cpramuk]

Yes, regex did it. Thanks for the pointers!