@to4kawa , Thank you so much! This is exactly what I was looking for. Here is what I used in my actual dashboard: index=myindex sourcetype=mynodestats
nodeName=$node_name$
| spath nodeName
| spath NIC output=nic
| rex field=nic mode=sed "s/,(\"eth\d\":)/#\1/g"
| makemv delim="#" nic
| rex field=nic mode=sed "s/.?\"eth\d\":(.*)}/\1/"
| mvexpand nic
| spath input=nic
| fields - _raw nic
| stats latest(linkSpeedInKbps) as "Speed (in Kbps)"
, latest(macAddress) as "MAC"
, latest("stats.network.received_pkts") as "Rx Pkts"
, latest("stats.network.transmitted_pkts") as "Tx Pkts"
, latest("stats.network.dropped_received_pkts") as "Dropped Rx Pkts"
, latest("stats.network.dropped_transmitted_pkts") as "Dropped Tx Pkts"
, latest("stats.network.error_received_pkts") as "Rx Pkt Errors"
, latest("stats.network.error_transmitted_pkts") as "Tx Pkt Errors" by name Worked like a charm!
... View more
