Reporting
Highlighted

Reporting on multiple fields

Path Finder

I'm trying to create a report off of 20 or so fields. The data set looks like the following:
{EVENTSMONITORINGCOUNT = {PUSHNOTIFICATIONSUSINGPROVIDERSDISABLED=0, MEMCACHEDKEYTOOLONG=0, EVENTTHROTTLERTOTALTHROTTLEDEVENTS=0, EVENTTHROTTLERTOTALPROCESSEDEVENTS=0, EVENTTHROTTLERNEWMSGBLEHPOSTSSKIPPED=0, EVENTTHROTTLERNEWMSGBLEHPOSTSPROCESSED=0, EVENTTHROTTLERNEWMSGBLAHRESPONDSTOYOURPOSTINMAINSKIPPED=0, EVENTTHROTTLERNEWMSGBLAHRESPONDSTOYOURPOSTINMAINPROCESSED=0, EVENTTHROTTLERNEWMSGBLAHPOSTSNEWTHREADINMAINSKIPPED=0, EVENTTHROTTLERNEWMSGBLAHPOSTSNEWTHREADINMAINPROCESSED=0, EVENTTHROTTLERNEWMSGBLAHPOSTSINSTUFFTEAMSKIPPED=0, EVENTTHROTTLERNEWMSGBLAHPOSTSINSTUFFTEAMPROCESSED=0, EVENTTHROTTLERNEWMSGBLAHPOSTSININDIVIDUALFORUMSKIPPED=0, EVENTTHROTTLERNEWMSGBLAHPOSTSININDIVIDUALFORUMPROCESSED=0, EVENTTHROTTLERDIDNOTPROCESSEVENTNONSUPPORTEDEVENT=0, EVENTTHROTTLERDIDNOTPROCESSEVENTMEMCACHELOOKUPERROR=0, EVENTTHROTTLERDIDNOTPROCESSEVENTINVALIDCOURSEID=0, EVENTCALLBACKTYPENOTSLECTED=0, EVENTCALLBACKTHREADEXECUTORBLOCKINGQUEUEFULL=0, EVENTCALLBACKPROFILEIDNULL=0, EVENTCALLBACKNOBLEHSINSTUFFTEAM=0, EVENTCALLBACKNOPROFILEIDFORTHISIRN=0, EVENTCALLBACKNOFORUMS=0, EVENTCALLBACKNODEVICESFORUSER=0, EVENTCALLBACKNOCLASSESFORCOURSECODE=0, EVENTCALLBACKNOACTIVECOURSES=0, EVENTCALLBACKMULTIPLECLASSESFORCOURSECODE=0, EVENTCALLBACKMOBILEDEVICENOTFOUND=0, EVENTCALLBACKINVALIDPAYLOAD=0, EVENTCALLBACKEXCEPTION=0, EVENTCALLBACKETUSERREMOVESPOST=0, EVENTCALLBACKETUSERREADSUNREADPOST=0, EVENTCALLBACKETUSERMARKSPOSTASUNREAD=0, EVENTCALLBACKETUSERMARKSENTIRETHREADASREAD=0, EVENTCALLBACKETNEWMSGBLEHRESPONDSTOYOURPOSTINMAIN=0, EVENTCALLBACKETNEWMSGBLEHPOSTSNEWTHREADINMAIN=0, EVENTCALLBACKETNEWMSGBLEHPOSTSINSTUFFTEAM=0, EVENTCALLBACKETNEWMSGBLEHPOSTSININDIVIDUALFORUM=0, EVENTCALLBACKETNEWMSGBLEHPOSTS=0, EVENTCALLBACKETNEWMSGOTHER=0, EVENTCALLBACKETNEWMSGBLAHRESPONDSTOYOURPOSTINMAIN=0, EVENTCALLBACKETNEWMSGBLAHPOSTSNEWTHREADINMAIN=0, EVENTCALLBACKETNEWMSGBLAHPOSTSINSTUFFTEAM=0, EVENTCALLBACKETNEWMSGBLAHPOSTSININDIVIDUALFORUM=0, EVENTCALLBACKETINVALIDEVENTTYPE=0, EVENTCALLBACKETBLAHGRADEDASSIGNMENTSCOREPOSTED=0, EVENTCALLBACKETDUPLICATEDELIVERY=0, EVENTCALLBACKDEVICETOKENNULL=0, EVENTCALLBACKDEVICEIDNULL=0, EVENTCALLBACKCLASSNOTFOUNDASACTIVE=0, EVENTCALLBACKCLASSNOTFOUND=0, APNSPAYLOADTOOBIG=0}}

So I want to build a report based on EVENT_*=x. The fields are defined but I cannot just do a wildcard on fields. Is there an efficient way of reporting on multiple fields within the same event log?

Thanks,

Rick

Tags (1)
0 Karma
Highlighted

Re: Reporting on multiple fields

Ultra Champion

Is this an example of a single event? Or is it a list of the possible events that may occur? Please post a few sample events, and be a bit more precise on what type of report you would like to construct.

/k

Highlighted

Re: Reporting on multiple fields

Path Finder

This is a single log entry that summarizes the number of events within a specific application. So each log entry will have this summarization. So I just want to report on all fields and their subsequent values in a nice chart -

0 Karma
Highlighted

Re: Reporting on multiple fields

Legend

Ok, but HOW do you want to report them? The stats command supports wildcards - what are you trying to do that isn't working?

0 Karma
Highlighted

Re: Reporting on multiple fields

Path Finder

Got it figured out in a very ugly manner - |timechart max(Event Name), max (Event Name2), max (event Name 3) etc.. etc.. This got the results that were needed - It is actually very useful when our developers who've embraced Splunk are now enhancing their code to be able to log specific events.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.