How to create a dashboard when required fields are not present in the event logs?

[moiezuddin]

I have a source="/opt/www/logs

i need the fields jobTitle, orgName, orgSegment, parentOrgname, and userType

Can anyone help provide the search?

[chimell]

Hi
If the file contain these fields
try like this

source="/opt/www/logs" | table jobTitle orgName orgSegment parentOrgname userType

[gyslainlatsa]

hi moiezuddin,

it is necessary to extract these fields using regular expressions before achieving dashboards using these fields. And for that you need to identify in your data the values corresponding to each field you need.
eg extraction of the field at random from your data:
source="dashboard_field.csv" host="student09-PC" index="field" sourcetype="csv" |rex "^[^'\n]*'(?P\w+'\))" |table type

this allows to retrieve the values of a certain type field that I choose.
try this and let me know if it works. or or you send me the file with which you work at [email protected], and I'll help you extract these fields and then send you the regular expressions that you will use to work with.

please forgive my english. after