Dashboards & Visualizations

charting raw data

jossaq
New Member

I have a raw entries like this:

[08/14/12 09:58:55] SNMP INFO request  received from 10.25.6.227  with unknown community string cable-d

the word after "string" varies form log to log.

I want to search something like this

... | chart count(word_after_"string") by host,word_after_string

How can I do that?

Reggards

Tags (1)
0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

You need to do a field extraction. Best choice is probably the rex command, though if you do this frequently you probably want to make it an automatic extraction in props.conf

... | rex field=_raw "string\w+(?<word_after_string>.*)$" | chart count by host, word_after_string

That should get you started, more details at:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

Ayn
Legend
... | rex "unknown community string (?<community_string>\S+)" | chart count by host,community_string
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...