Creating a Dashboard

Comments

4 comments

  • Avatar
    Eli Jang

    1. Refer to here 

    2. Refer to here

    0
    Comment actions Permalink
  • Avatar
    Smooth Operator

    Thank you E Jang. Can you please help me with this?

    In Splunk I use Regex to extract the key items from a query and use Eval command to make the expression much meaningful and look pretty. 

    Ex: 

    | rex field=_raw "(?<Date>\w{3}\s+\d+ \d+:\d+:\d+) (?<hostname>.+) \d+: \w{3}.*User:(?<user>\w+).*:(?P<command>.......)"

    |eval "Command Execution on the Network" = Date + " " + "Enable Command on " + host + " was executed by " + user

    | table "Command Execution on the Network"


    I extracted a regex command for SumoLogic and I want to know what is the way to get a similar beautiful output from SumoLogic.
    From the below-mentioned regex, I want to have a table of which each row says

    On <Date> User <Name> has logged into <Server> <Connection> <status>


    | parse regex "\d+\S\d+\S\d+\w+\S\d+\S\d+\S\d+\S\d+\s(?<Server>\w+\S\w+\s\w+)\S\w+\S\w+\S\s(?<Date>\w+\s\w+\s\w+\s\w+\S\w+\S\w+)\s\w+\s(?<Name>\w+.\w+)\S\d+\S\d+\S\d+\d+\S\d+\S\d+\S\s(?<Connection>\w+)\s(?<status>\w+).*"

    Please help. 

    Thank you. 

    0
    Comment actions Permalink
  • Avatar
    Eli Jang

    Use concat operator.
    for example, 

    | concat ("On ", Date, " User ", Name, " has logged into ", Server, " ", Connection, " ", Status) as output
    | count by output

    0
    Comment actions Permalink
  • Avatar
    Smooth Operator

    Thank you Eli Jang. I really appreciate your help. 

    0
    Comment actions Permalink

Please sign in to leave a comment.