Dashboards & Visualizations

Parsing logs of multiple types for visualizing in Dashboard

cpramuk
Explorer

I hope you can help me with a dashboard line  visualization I’m trying to make.

Here is an example of our logs, which keep count at the end of each line :
[db]: 00:05:01.000: newcoteachers:1d 115

[db]: 00:05:01.000: newcoteachers:7d 528

[db]: 00:05:01.000: newcoteachers:30d 1884

 

How can I chart three lines graph in one splunk dashboard panel to represent these numbers? I feel like I'm close but I've hit a wall and cannot find any documentation to help.

The query below only returns the “1d” type. Is it possible to chart the three types?

rex field=_raw  "newteachers:(?<type>.*) (?<num>.*)"  | chart last(num) by type

 

Thanks for any help

 

Christian

Labels (2)
0 Karma
1 Solution

cpramuk
Explorer

That is so great, thank you for helping me!! 

While I have your attention. How can I exclude a type from the query, such as "total", and only dashboard the other 3 types

[db]: 00:05:01.000: newcoteachers:1d 115

[db]: 00:05:01.000: newcoteachers:7d 528

[db]: 00:05:01.000: newcoteachers:30d 1884

[db]: 00:05:01.000: newcoteachers:total 1884

I owe you a pizza! Thanks!

 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you can do it this way

| makeresults 
| eval _raw = "[db]: 00:05:01.000: newcoteachers:1d 115
[db]: 00:05:01.000: newcoteachers:7d 528
[db]: 00:05:01.000: newcoteachers:30d 1884" 
| multikv noheader=t 
| fields _raw 
| rex "newcoteachers:(?<type>\w+)\s+(?<num>\d+)" 
| chart last(num) by type

r. Ismo 

cpramuk
Explorer

That is so great, thank you for helping me!! 

While I have your attention. How can I exclude a type from the query, such as "total", and only dashboard the other 3 types

[db]: 00:05:01.000: newcoteachers:1d 115

[db]: 00:05:01.000: newcoteachers:7d 528

[db]: 00:05:01.000: newcoteachers:30d 1884

[db]: 00:05:01.000: newcoteachers:total 1884

I owe you a pizza! Thanks!

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Nice to help you.
You should look regex and where command on this page https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands
0 Karma

cpramuk
Explorer

Yes, regex did it. Thanks for the pointers!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>