如何解决使用日志中的值在splunk中统计图表
我是Splunk仪表板的新手。我需要这类数据的帮助。
2020-09-22 11:14:33.328+0100 org{abc} INFO 3492 --- [hTaskExecutor-1] c.j.a.i.p.v.b.l.ReadFileStepListener : [] read-feed-file-step ended with status exitCode=COMPLETED;exitDescription= with compositeReadCount 1 and other count status as: BatchStatus(readCount=198,multiEntityAccountCount=0,readMultiAccountEntityAdjustment=0,accountFilterSkipCount=7,broadRidgeFilterSkipCount=189,writeCount=2,taskCreationCount=4)
我想在仪表板中显示统计信息,以显示上述日志中的所有整数值。
编辑1:
我尝试了这个但没有用。
index=abc xyz| rex field=string .*readCount=(?P<readCount>\d+) | table readCount
解决方法
看看这个无处不在的例子是否有帮助。
| makeresults
| eval _raw="2020-09-22 11:14:33.328+0100 org{abc} INFO 3492 --- [hTaskExecutor-1] c.j.a.i.p.v.b.l.ReadFileStepListener : [] read-feed-file-step ended with status exitCode=COMPLETED;exitDescription= with compositeReadCount 1 and other count status as: BatchStatus(readCount=198,multiEntityAccountCount=0,readMultiAccountEntityAdjustment=0,accountFilterSkipCount=7,broadRidgeFilterSkipCount=189,writeCount=2,taskCreationCount=4)"
`comment("Everything above just sets up test data")`
| extract kvdelim=",",pairdelim="="
| timechart span=1h max(*Count) as *Count
,
我用
解决了这个问题index=xyz |regex ".*fileName=(\s*([\S\s]+))" | rex field=string .*compositeReadCount=(?P<compositeReadCount>\d+) |regex ".*readCount=(?P<readCount>\d+)" | regex ".*multiEntityAccountCount=(?P<multiEntityAccountCount>\d+)" | regex ".*readMultiAccountEntityAdjustment=(?P<readMultiAccountEntityAdjustment>\d+)" | regex ".*accountFilterSkipCount=(?P<accountFilterSkipCount>\d+)" | regex ".*broadRidgeFilterSkipCount=(?P<broadRidgeFilterSkipCount>\d+)" | regex ".*writeCount=(?P<writeCount>\d+)" | regex ".*taskCreationCount=(?P<taskCreationCount>\d+)" | regex ".*status=(\s*([\S\s]+))" | table _time fileName compositeReadCount readCount multiEntityAccountCount readMultiAccountEntityAdjustment accountFilterSkipCount broadRidgeFilterSkipCount writeCount taskCreationCount status
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。