How to extract these fields from my sample data to create a time chart on my dashboard?

[krishnacasso]

 [11627/3721370512][Sun Sep 10 2015 21:00:02][CServer.cpp:4448][INFO] Connections: Current=289 Max=1349 Limit=10000 Exceeded limit=   0

Tried extracting the field and creating a time chart based on the fluctuations of values Current, Max, Limit, Exceeded limit.

Somehow I am getting the Null added to the table which I don't want to see.
Can some one help me to develop a dashboard for this having time on x-axis and values Current, Max, Limit, Exceeded limit on Y-axis.

Thanks.

[gokadroid]

My answer is exactly same as @somesoni2 's search except it contains field extractions (which anyways should have been auto extracted) and uses useother & usenull switches. Try below one if you like:

yourBaseSearch
| rex field=_raw ".*Current=(?< current>[\d]+)\s+?Max=(?< max>[\d]+)\s+?Limit=(?< limit>[\d]+)\s+?Exceeded\s+?limit=\s+?(?< ExceededLimit>[\d]+)"
| timechart avg(current) as Current, avg(max) as Max, avg(limit) as Limit, avg(ExceededLimit) as "Exceeded Limit" useother=f usenull=f

Remove the space from each of the tags: < current>, < max>, < limit> and < ExceededLimit> in the regex above*

[somesoni2]

What is the query that you tried? Since the values for Current, Max, Limit and (Exceeded) limit is appearing as key value pair, they should automatically be extracted, is it not happening for you?

Give this a try as well

your base search | timechart avg(Current) as Current avg(Max) as Max avg(Limit) as Limit avg(limit) as "Exceeded Limit"

[rjthibod]

Wouldn't this depend on the sourcetype? The sourcetype will need to be set to for KV_MODE=auto (which is the default), but we would need to know what sourcetype is being set for these events in case KV_MODE is being overwritten in some way.

Assuming KV fields are being extracted @somesoni2 response should work unless something else is going on, e.g., Timestamp extraction is not working correctly.