I'm trying to extract and dashboard the latest number in my logs for each "7d" stat. Some sample logs: [db]: 00:05:01.000: 3ddesigns:total 173304125 [db]: 00:05:01.000: 3ddesigns:1d 253113 [db]: 00:05:01.000: 3ddesigns:7d 1435675 [db]: 00:05:01.000: 3ddesigns:30d 5863610 [db]: 00:05:01.000: 3dlessons:total 92148058 [db]: 00:05:01.000: 3dlessons:1d 103077 [db]: 00:05:01.000: 3dlessons:7d 539695 [db]: 00:05:01.000: 3dlessons:30d 2216809 [db]: 00:05:01.000: circuitsdesigns:total 62150103 [db]: 00:05:01.000: circuitsdesigns:1d 125770 [db]: 00:05:01.000: circuitsdesigns:7d 724227 [db]: 00:05:01.000: circuitsdesigns:30d 2936667 I have a search query but it gives me a Null field...is there a way to rename the fields?: obs_mnkr="tnkrcad-p-ue1" source="/disk/logtxt/stats.log" | multikv noheader=t | fields _raw | rex "3ddesigns:(?<designs>\w+)\s+(?<num>\d+)" | regex designs!="1d" | regex designs!="30d" | regex designs!="total" | rex "circuitsdesigns:(?<circuits>\w+)\s+(?<num>\d+)" | regex circuits!="1d" | regex circuits!="30d" | regex circuits!="total" | timechart span=1w last(num) by designs   ... View more

I hope you can help me with a dashboard line  visualization I’m trying to make. Here is an example of our logs, which keep count at the end of each line : [db]: 00:05:01.000: newcoteachers:1d 115 [db]: 00:05:01.000: newcoteachers:7d 528 [db]: 00:05:01.000: newcoteachers:30d 1884   How can I chart three lines graph in one splunk dashboard panel to represent these numbers? I feel like I'm close but I've hit a wall and cannot find any documentation to help. The query below only returns the “1d” type. Is it possible to chart the three types? rex field=_raw  "newteachers:(?<type>.*) (?<num>.*)"  | chart last(num) by type   Thanks for any help   Christian ... View more