Reporting on multiple fields

[rjyetter]

I'm trying to create a report off of 20 or so fields. The data set looks like the following:
{EVENTS_MONITORING_COUNT = {PUSH_NOTIFICATIONS_USING_PROVIDERS_DISABLED=0, MEMCACHED_KEY_TOO_LONG=0, EVENT_THROTTLER_TOTAL_THROTTLED_EVENTS=0, EVENT_THROTTLER_TOTAL_PROCESSED_EVENTS=0, EVENT_THROTTLER_NEW_MSG_BLEH_POSTS_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLEH_POSTS_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM_PROCESSED=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_NON_SUPPORTED_EVENT=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_MEMCACHE_LOOKUP_ERROR=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_INVALID_COURSE_ID=0, EVENT_CALLBACK_TYPE_NOT_SLECTED=0, EVENT_CALLBACK_THREAD_EXECUTOR_BLOCKING_QUEUE_FULL=0, EVENT_CALLBACK_PROFILE_ID_NULL=0, EVENT_CALLBACK_NO_BLEHS_IN_STUFF_TEAM=0, EVENT_CALLBACK_NO_PROFILE_ID_FOR_THIS_IRN=0, EVENT_CALLBACK_NO_FORUMS=0, EVENT_CALLBACK_NO_DEVICES_FOR_USER=0, EVENT_CALLBACK_NO_CLASSES_FOR_COURSE_CODE=0, EVENT_CALLBACK_NO_ACTIVE_COURSES=0, EVENT_CALLBACK_MULTIPLE_CLASSES_FOR_COURSE_CODE=0, EVENT_CALLBACK_MOBILE_DEVICE_NOT_FOUND=0, EVENT_CALLBACK_INVALID_PAYLOAD=0, EVENT_CALLBACK_EXCEPTION=0, EVENT_CALLBACK_ET_USER_REMOVES_POST=0, EVENT_CALLBACK_ET_USER_READS_UNREAD_POST=0, EVENT_CALLBACK_ET_USER_MARKS_POST_AS_UNREAD=0, EVENT_CALLBACK_ET_USER_MARKS_ENTIRE_THREAD_AS_READ=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_RESPONDS_TO_YOUR_POST_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_NEW_THREAD_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_IN_STUFF_TEAM=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_IN_INDIVIDUAL_FORUM=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS=0, EVENT_CALLBACK_ET_NEW_MSG_OTHER=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM=0, EVENT_CALLBACK_ET_INVALID_EVENT_TYPE=0, EVENT_CALLBACK_ET_BLAH_GRADED_ASSIGNMENT_SCORE_POSTED=0, EVENT_CALLBACK_ET_DUPLICATE_DELIVERY=0, EVENT_CALLBACK_DEVICE_TOKEN_NULL=0, EVENT_CALLBACK_DEVICE_ID_NULL=0, EVENT_CALLBACK_CLASS_NOT_FOUND_AS_ACTIVE=0, EVENT_CALLBACK_CLASS_NOT_FOUND=0, APNS_PAYLOAD_TOO_BIG=0}}

So I want to build a report based on EVENT_*=x. The fields are defined but I cannot just do a wildcard on fields. Is there an efficient way of reporting on multiple fields within the same event log?

Thanks,

Rick

[rjyetter]

Got it figured out in a very ugly manner - |timechart max(Event Name), max (Event Name2), max (event Name 3) etc.. etc.. This got the results that were needed - It is actually very useful when our developers who've embraced Splunk are now enhancing their code to be able to log specific events.

[Ayn]

Ok, but HOW do you want to report them? The stats command supports wildcards - what are you trying to do that isn't working?

[rjyetter]

This is a single log entry that summarizes the number of events within a specific application. So each log entry will have this summarization. So I just want to report on all fields and their subsequent values in a nice chart -

[kristian_kolb]

Is this an example of a single event? Or is it a list of the possible events that may occur? Please post a few sample events, and be a bit more precise on what type of report you would like to construct.

/k