Splunk Search

How to create a dashboard when required fields are not present in the event logs?

moiezuddin
Explorer

I have a source="/opt/www/logs

i need the fields jobTitle, orgName, orgSegment, parentOrgname, and userType

Can anyone help provide the search?

0 Karma

chimell
Motivator

Hi
If the file contain these fields
try like this

source="/opt/www/logs" | table jobTitle orgName orgSegment parentOrgname userType
0 Karma

gyslainlatsa
Motivator

hi moiezuddin,

it is necessary to extract these fields using regular expressions before achieving dashboards using these fields. And for that you need to identify in your data the values corresponding to each field you need.
eg extraction of the field at random from your data:
source="dashboard_field.csv" host="student09-PC" index="field" sourcetype="csv" |rex "^[^'\n]*'(?P\w+'\))" |table type

this allows to retrieve the values of a certain type field that I choose.
try this and let me know if it works. or or you send me the file with which you work at gyslainko@gmail.com, and I'll help you extract these fields and then send you the regular expressions that you will use to work with.

please forgive my english. after

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...