|
Hi All, I have a website which produces statistics and it is shown like this(over 1K lines, so just pasting a few) Each line is produced for each server(e.g there are 2/3 servers) which are seperated by <number><counters></counters></number> : <distributed> <3> null <2> RealDBMisc.aborted.hod.-1.number = 0 RealDBMisc.aborted.hod.-1.total = 0 RealDBMisc.aborted.hod.-1.avarage = 0 UserDBMisc.aborted.hod.-1.number = 0 UserDBMisc.aborted.hod.-1.avarage = 0 UserDBMisc.aborted.hod.-1.total = 0 ipc.Routing.RouteCostRequest.success.hod.-1.total = 15204 ipc.vs-changeVenueProduct.success.hod.-1.number = 82 </distributed> The statistics are for the past hour, so the collection is also per hour I'm looking for a regex syntax to help me filter fields and create graphs, for example I want a graph to show me the numbers after UserDBMisc.aborted.hod.-1.avarage for a custom time Thanks in advance |
|
I'm a little fuzzy on understanding this one, is that one event? It might help (me and others) to see what three events would like like from this source. I'm sure we can figure it out :) One event gives out over 1000 lines of data, each line is a statistic event, however those events can be in multiple servers(divided by the <number> such as <2>) I need somehow to tell Splunk to know those fields so I can create graphs on each field as I wish Thanks
(05 Aug '12, 22:15)
nirt
Small correction: I have a source that gives a lot of statistic information, each line is different content for example: pc.DDBRemoveCache.alerts.success.hod.-1.total = 527 ipc.DDBRemoveCache.alerts.success.hod.-1.avarage = 1 ipc.DDBRemoveCache.alerts.success.hod.-1.number = 527 ipc.DDBUpdateCache.alerts.success.hod.-1.number = 161 ipc.DDBUpdateCache.alerts.success.hod.-1.total = 161 ipc.DDBUpdateCache.alerts.success.hod.-1.avarage = 1 so it's quite simple: name = value but I can't seem to get the regex properly working
(06 Aug '12, 01:26)
nirt
|
|
Something like this?: |
