How to create a dashboard using the extracted field values

[amit2312]

Hi All,

I have the log file like below :

[Request BEGIN] Session ID - 1234gcy6789rtcd, Request ID - 2605, Source IP - 123.245.7.66, Source Host - 123.245.7.98, Source Port - 78690, xyz Engine - XYZS_BPM_Service, PNO - 1234, Service ID - abc12nf

[Request END] Success : 

[Request BEGIN] Session ID - 1234gcy6789rtcd, Request ID - 2605, Source IP - 123.245.7.66, Source Host - 123.245.7.98, Source Port - 78690, xyz Engine - XYZS_BPM_Service, PNO - 1234, Service ID - abc12nf

[Request END] Success :  Details about the failure

along with above details there are lot of details in the log but these are the detail i need to create a dashboard,

Can anyone please help me on

how to extract all the above field.

and how can a create a dashboard for how many request are successful along with details about the success request like IP and service name etc.

Thanks a lot in advance.

Regards,

AKM

[ITWhisperer]

Is this just one event or two or four? If four, how do you relate Request END to its corresponding Request BEGIN?

What fields, if any, do you already have extracted?

[amit2312]

Hi,

Thanks for the reply. Yes it's one event it starts with begin. I want extract fields like

xyz Engine, service id, ip, PNO

Regards,

AKM

[ITWhisperer]

You could try something like this

| rex max_match=0 "(?m)(?<namevalue>(?<=(\]|,)\s).+?(?=\s\-\s)\s-\s[^,]+?(?=,|$))(,|$)"
| mvexpand namevalue
| rex field=namevalue "(?<name>.+?(?=\s\-\s))\s-\s(?<value>[^,]+?(?=,|$))"
| eval {name}=value
| stats values(*) as * by _raw

[amit2312]

Hi,

Thanks for the reply, it gives me all the details but its making all the details in event in columns. Could you please help me how can i get selected fields in a table.

Like :

PNO | Engine|Status|Service Acount.

Regards,

AKM

[ITWhisperer · Accepted solution]

Just list the fields that you want after the table command

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Table

[amit2312]

Hi,

Thanks a lot for your help, it really helped.

Regards,

AKM