Splunk Search

Rename source in chart

gnovak
Builder

I have a dashboard that is displaying 3 charts and a table. In the 3 charts the legend mostly consists the source path of the logs files that are being displayed in the charts. The source path is pretty long and I'd really like to just have the source path displayed as one word describing each source.

I really only want it for these charts on the dashboard and not all throughout splunk. Anyone have an idea of what the best way to do this? Do I have to put something in the actual search to tell splunk to relabel the source?

Example: /opt/log/sandstorm/home/dataserver.log.

I want it displayed in chart as just Sandstorm and not /opt/log/sandstorm/home/dataserver.log

Tags (1)
0 Karma
1 Solution

Ayn
Legend

In the search you're using to generate each graph, sometime before your stats/chart/timechart command, create a new field that holds only the last portion of the source field:

... | rex field=source "/(?<source_short>[^/]+)$"

Then split by that field instead of by source.

View solution in original post

0 Karma

Ayn
Legend

In the search you're using to generate each graph, sometime before your stats/chart/timechart command, create a new field that holds only the last portion of the source field:

... | rex field=source "/(?<source_short>[^/]+)$"

Then split by that field instead of by source.

0 Karma

gnovak
Builder

This worked! sourcetype="cron_BalanceEmail" NOT host=".bmp2." earliest=-1d@d latest=-0d@d sent ([BalanceEmail] OR [null]) | rex field=_raw "\w+] ?(?[\d]+) of (?[\d]+) of email notification sent." | rex field=source "/(?[^/]+)/[^/]+/[^/]+$" | table source_short TotalEmailsToSend TotalEmailsSent | dedup source_short

0 Karma

gnovak
Builder

The field listed was the last portion of the log path. If the log path is /opt/log/dotinfo/eppcron/eppcron_balancememail.log, it listed as the source_short as only eppcron_balanceemail.log. I should list dotinfo.

0 Karma

gnovak
Builder

Ok it did make a source_short field but the source listed isn't correct. I will try again

0 Karma

gnovak
Builder

i tried renaming source_short to other things, didnt' work. I tried making the regex | rex field=source "/opt/log/(?[^/]+)$" and that also didn't work. I'm not the best at regex but I've got a handy chart here...still trying different things!

0 Karma

gnovak
Builder

If i add this, the results in the table are still the same: sourcetype="cron_BalanceEmail" NOT host=".bmp2." earliest=-1d@d latest=-0d@d sent ([BalanceEmail] OR [null]) | rex field=_raw "\w+] ?(?[\d]+) of (?[\d]+) of email notification sent." | rex field=source "/(?[^/]+)$" | table source TotalEmailsToSend TotalEmailsSent | dedup source

0 Karma

gnovak
Builder

I didn't add that to my response because what I had didn't work. I'm still working on it.

0 Karma

Ayn
Legend

I don't see the rex command to create a short version of the source field in there?

0 Karma

gnovak
Builder

The location of the sourcetype for all of these logs is in the same location but each one is named differently. such as /opt/log/sandstorm/logs/sandstorm.log, /opt/log/snowstorm/logs/snowstorm.log, etc. I just want the main words like Sandstorm or Snowstorm to show up for source. I'll keep trying but any other comments are welcome!

0 Karma

gnovak
Builder

Well I tried doing this but I haven't seen the result I need. My search I was using was: sourcetype="cron_BalanceEmail" NOT host=".bmp2." earliest=-1d@d latest=-0d@d sent ([BalanceEmail] OR [null]) | rex field=_raw "\w+] ?(?[\d]+) of (?[\d]+) of email notification sent." | table source TotalEmailsToSend TotalEmailsSent | dedup source

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...