Dashboards & Visualizations

charting raw data

jossaq
New Member

I have a raw entries like this:

[08/14/12 09:58:55] SNMP INFO request  received from 10.25.6.227  with unknown community string cable-d

the word after "string" varies form log to log.

I want to search something like this

... | chart count(word_after_"string") by host,word_after_string

How can I do that?

Reggards

Tags (1)
0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

You need to do a field extraction. Best choice is probably the rex command, though if you do this frequently you probably want to make it an automatic extraction in props.conf

... | rex field=_raw "string\w+(?<word_after_string>.*)$" | chart count by host, word_after_string

That should get you started, more details at:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

Ayn
Legend
... | rex "unknown community string (?<community_string>\S+)" | chart count by host,community_string
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!