Splunk Search

How can I create a chart using the value for each drive in my sample data?

andrei1bc
Communicator

Hello

I have the following event. Is there any way to create a chart using the value for each drive? Thank you in advance.

Collection = WindowsHDD 
Counter = Drive C:
Value =  49.89 GB

Collection = WindowsHDD 
Counter = Drive D:
Value =  1,451.76 GB
Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Sorry for multiple edits, I forgot angle brackets get eaten sometimes by the inline code tags so I converted one to an ugly code block.

One way would be to use Regex to create a tiny bit of structure. If I'm reading this right, at the moment your problem is that though you may have fields named "counter" and "value", you can't actually correlate which counter goes with which value. So, let's create a few variables.

I'll show you a sort of brute force way because it's more clear. Don't be scared by the rex, I'll explain in a bit.

...my search that returns the above events... | rex field=_raw "(?m)Drive\s+C:\s+Value\s+=\s+(?<c_drive>[^ ]+)"

The string for the rex says...
(?m) - search across multiple lines
Drive - find the exact string Drive
\s+ - followed by one or more spaces or other whitespace characters
C:\s+Value\s+=\s+ More strings and spaces in a certain order
(?...) These indicate I'm creating a new field out of the next things I specify

<c_drive>  ( Name whatever I find as the fieldname c_drive)

[^ ]+ The plus says to match one or more of the items inside the brackets, EXCEPT the first character inside the bracket is ^ which means NOT. So what it's actually saying is to match one or more non-space characters, so it'll then grab 49.49 or whatever up to the next space.

You can repeat the entire thing changing a few small variables and create a second rex for d_drive.

...my search that returns the above events... 
| rex field=_raw "(?m)Drive\s+C:\s+Value\s+=\s+(?<c_drive>[^ ]+)"
| rex field=_raw "(?m)Drive\s+D:\s+Value\s+=\s+(?<d_drive>[^ ]+)"

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

Sorry for multiple edits, I forgot angle brackets get eaten sometimes by the inline code tags so I converted one to an ugly code block.

One way would be to use Regex to create a tiny bit of structure. If I'm reading this right, at the moment your problem is that though you may have fields named "counter" and "value", you can't actually correlate which counter goes with which value. So, let's create a few variables.

I'll show you a sort of brute force way because it's more clear. Don't be scared by the rex, I'll explain in a bit.

...my search that returns the above events... | rex field=_raw "(?m)Drive\s+C:\s+Value\s+=\s+(?<c_drive>[^ ]+)"

The string for the rex says...
(?m) - search across multiple lines
Drive - find the exact string Drive
\s+ - followed by one or more spaces or other whitespace characters
C:\s+Value\s+=\s+ More strings and spaces in a certain order
(?...) These indicate I'm creating a new field out of the next things I specify

<c_drive>  ( Name whatever I find as the fieldname c_drive)

[^ ]+ The plus says to match one or more of the items inside the brackets, EXCEPT the first character inside the bracket is ^ which means NOT. So what it's actually saying is to match one or more non-space characters, so it'll then grab 49.49 or whatever up to the next space.

You can repeat the entire thing changing a few small variables and create a second rex for d_drive.

...my search that returns the above events... 
| rex field=_raw "(?m)Drive\s+C:\s+Value\s+=\s+(?<c_drive>[^ ]+)"
| rex field=_raw "(?m)Drive\s+D:\s+Value\s+=\s+(?<d_drive>[^ ]+)"
0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...