Splunk Search

How to create a dashboard using the extracted field values

amit2312
Explorer

Hi All,

I have the log file like below :

[Request BEGIN] Session ID - 1234gcy6789rtcd, Request ID - 2605, Source IP - 123.245.7.66, Source Host - 123.245.7.98, Source Port - 78690, xyz Engine - XYZS_BPM_Service, PNO - 1234, Service ID - abc12nf

[Request END] Success : 

[Request BEGIN] Session ID - 1234gcy6789rtcd, Request ID - 2605, Source IP - 123.245.7.66, Source Host - 123.245.7.98, Source Port - 78690, xyz Engine - XYZS_BPM_Service, PNO - 1234, Service ID - abc12nf

[Request END] Success :  Details about the failure

 

along with above details there are lot of details in the log but these are the detail i need to create a dashboard,

Can anyone please help me on

how to extract all the above field.

and how can a create a dashboard for how many request are successful along with details about the success request like IP and service name etc.

Thanks a lot in advance.

Regards,

AKM

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is this just one event or two or four? If four, how do you relate Request END to its corresponding Request BEGIN?

What fields, if any, do you already have extracted?

0 Karma

amit2312
Explorer

Hi,

Thanks for the reply. Yes it's one event it starts with begin. I want extract fields like

xyz Engine, service id, ip, PNO

Regards,

AKM

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

| rex max_match=0 "(?m)(?<namevalue>(?<=(\]|,)\s).+?(?=\s\-\s)\s-\s[^,]+?(?=,|$))(,|$)"
| mvexpand namevalue
| rex field=namevalue "(?<name>.+?(?=\s\-\s))\s-\s(?<value>[^,]+?(?=,|$))"
| eval {name}=value
| stats values(*) as * by _raw
0 Karma

amit2312
Explorer

Hi,

Thanks for the reply, it gives me all the details but its making all the details in event in columns. Could you please help me how can i get selected fields in a table.

Like :

PNO | Engine|Status|Service Acount.

 

Regards,

AKM

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Just list the fields that you want after the table command

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Table

 

0 Karma

amit2312
Explorer

Hi,

Thanks a lot for your help, it really helped.

Regards,

AKM

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...