Extract values to be shown in table

[adityapavan18]

I have a event similiar to one below:

Server Status - ServerName - RUNNING

JMS Queue - ServerName : Module1!JMSServer1@QueueName1 , 0, 0, 13, 45, 0, 1345, 800

JMS Queue - ServerName : Module2!JMSServer1@QueueName2 , 0, 0, 3, 14, 0, 15, 800

JMS Queue - ServerName : Module3!JMSServer2@QueueName3 , 0, 0, 23, 24, 0, 13, 800

JMS Queue - ServerName : Module4!JMSServer3@QueueName4 , 0, 0, 25, 35, 0, 1, 800

JMS Bridge - ServerName:BridgeName1,Forwarding messages.

JMS Bridge - ServerName:BridgeName2,Forwarding messages.

This complete snippet is a single event.
This gets written onto a file at regular interval (JMS Queues and JMS Bridges status) which is monitored by splunk,and this complete thing is indexed as a single event with multiple lines,

Now i would like to extract info from this event and show in following table format in panel in dashboard

QueueName Field1 Field2 Field3 Field4 Field5 Field6 Field7

QueueName1 0 0 13 45 0 1345 800

QueueName2 0 0 3 14 0 15 800

QueueName3 0 0 23 24 0 13 800

QueueName4 0 0 25 35 0 1 800

[bmacias84]

You could build a field extraction for a every field or you could build one for the entire event. Below is a regex statement I've tested with your sample.

(?ms)(?P<queuename>[^\s@]+)\s,\s(?P<value1>[^\s,]+),\s(?P<value2>[^\s,]+),\s(?P<value3>[^\s,]+),\s(?P<value4>[^\s,]+),\s(?P<value5>[^\s,]+),\s(?P<value6>[^\s,]+),\s(?P<value7>[^\s,]+)$

[bmacias84]

Then you would append ...|queuename =

Or

...| chart span=5m avg(value4) as value by queuename.

I dont know what your trying to accomplish with your report or chart.

[adityapavan18]

even if i do it, that complete thing being a single event.
If I need to extract details for only 1 queue say QueueName3.
I will get all the details for all Queues as it is a single event.