hi @all
i've got files like this:
2011-03-20 20:36:12 server=sxxxxx env=DEV os=LINUX stateDiskPath=0 stateRouting=1 stateBackup=1 statePuppet=1 stateTotal=1
First: I don't know how I can change the host-field to servername
Second: Can I create an extended Dashboard like:
Server1 Env OS state1 state2 state3 state4 stateTotal
The states should be like green and red bubbles.
Is this possible and how can I do this? I'm new in splunk and havn't an idea if this is possible or not.
Thanks for replay!
You can change the host field at index time with a "TRANSFORMS" property:
## props.conf [mysourcetype] TRANSFORMS-force_host_for_mysourcetype = force_host_for_mysourcetype ## transforms.conf [force_host_for_mysourcetype] DEST_KEY = MetaData:Host REGEX = \d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+server=(\S+) FORMAT = host::$1
You can create a dashboard using the following search. The dashboard creation itself can be a bit tricky. We may have to incorporate the "rangemap" search command and map 0=low 1=severe.
sourcetype=mysourcetype | stats last(state1) as state1, last(state2) as state2, last(state3) as state3, last(state4) as state4 by server, env, os | addtotals fieldname=stateTotal
You can change the host field at index time with a "TRANSFORMS" property:
## props.conf [mysourcetype] TRANSFORMS-force_host_for_mysourcetype = force_host_for_mysourcetype ## transforms.conf [force_host_for_mysourcetype] DEST_KEY = MetaData:Host REGEX = \d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+server=(\S+) FORMAT = host::$1
You can create a dashboard using the following search. The dashboard creation itself can be a bit tricky. We may have to incorporate the "rangemap" search command and map 0=low 1=severe.
sourcetype=mysourcetype | stats last(state1) as state1, last(state2) as state2, last(state3) as state3, last(state4) as state4 by server, env, os | addtotals fieldname=stateTotal