how can I format and chart a status message?

[msantich]

Hello,
a device in our system returns a status message that looks like the following (as seen in splunk search results)

state (UP | DN| STDBY | UNK); parma: (string) , parmb:(int), etc

notice that there is no delimiter between "state" and the value of state
notice also that some parameters have integer values and some are strings. most of the parameters that are strings are limited to true/false, or up/down, etc.....

I'd like to have a realtime chart/display that is updated once/interval I choose.

for the parameters that have string values, it's OK to translate those to a numerical or color representation for display

I'm trying to read and understand how to use the chart command, but I'm having a hard time translating the "syntax" descriptions to "real life"....

I'd appreciate some help getting started on my learning curve.

thanks so much

[msantich]

Thanks all,
between your suggestions and finding splunk app will do most of this work for me, I'm seeing some light....

thanks for the quick feedback

have a great day.

[msantich]

Thank you. here is an excerpt from specific event
state SYNCED; deltatime: 57, datamoving: true, outcount: 50

this status event is provided once/second and I'd like a moving guage/bar, etc that responds to deltaTime and another moving guage/bar that responds to outcount, and perhaps set a "redline" with an alert that triggers when a value exceeds the redline...

Thank you very much.

[Runals · Accepted solution]

From your description it doesn't seem like the fields have been defined in your data. As richgalloway mentioned having some more sample data would help. Assuming there is a space between state and state value and just going with parameter A where that is really parama you could try something like this I suppose.

... | rex "state "(?<state>\S)" | rex "parama: (?<parama>.+)\s," | chart count over state by parama

[msantich]

Thank you. here is an excerpt from specific event
state SYNCED; deltatime: 57, datamoving: true, outcount: 50

this status event is provided once/second and I'd like a moving guage/bar, etc that responds to deltaTime and another moving guage/bar that responds to outcount, and perhaps set a "redline" with an alert that triggers when a value exceeds the redline...

Thank you very much.

[somesoni2]

Can we have some mock expected output and some real sample events?

[msantich]

Thank you. here is an excerpt from specific event
state SYNCED; deltatime: 57, datamoving: true, outcount: 50

this status event is provided once/second and I'd like a moving guage/bar, etc that responds to deltaTime and another moving guage/bar that responds to outcount, and perhaps set a "redline" with an alert that triggers when a value exceeds the redline...

Thank you very much.

[richgalloway]

Some example data would be useful. Is "state" and its value separated by a space or is there no separation?

What exactly are you wanting to graph?

[msantich]

Thank you. here is an excerpt from specific event
state SYNCED; deltatime: 57, datamoving: true, outcount: 50

this status event is provided once/second and I'd like a moving guage/bar, etc that responds to deltaTime and another moving guage/bar that responds to outcount, and perhaps set a "redline" with an alert that triggers when a value exceeds the redline...

Thank you very much.