Hi Everyone,
Currently i am monitoring the *.log files under a path, i have not given a source name since we dont have a definite source The file names keep on updating
My Inputs.conf
[monitor://[path]\*.log]
disabled = 0
index = test
sourcetype = sourcetypetest
When the data is indexed into splunk, it is giving the source names as "E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log'' where as i just want to extract the 'user-MemoCPU' field in the source and display in a dashboard panel. Please let me know if its possible
I am building a dashboard panel with below query,
index = test | stats count by source | sort -count
Yes,
For the first one just extract the user part:
index = test | rex field=source "\\\\(?<source>\w+)-\w+.log$" | stats count by source | sort -count
For the second one:
index = test | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | table source, issue
If this reply helps you, an upvote/like would be appreciated.
Thanks, this worked like a charm.
output is shown as below
source count
user-MemoCPU 1
Is there a way i can show output as just like below
source count
user 1
or
source issue
user MemoCPU
Yes,
For the first one just extract the user part:
index = test | rex field=source "\\\\(?<source>\w+)-\w+.log$" | stats count by source | sort -count
For the second one:
index = test | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | table source, issue
If this reply helps you, an upvote/like would be appreciated.
Thanks a lot, both working fine !
You are welcome! Upvotes will be appreciated!
You can use rex to extract the only filename:
index = test | rex field=source "(?<source>[^\\\\]+)\.log$" | stats count by source | sort -count
If this reply helps you, an upvote/like would be appreciated.