splunk - 使用日志中的值在 splunk 中的统计图表

Question

我是 Splunk 仪表板的新手。我需要一些有关此类数据的帮助。

2020-09-22 11:14:33.328+0100 org{abc}  INFO  3492 --- [hTaskExecutor-1] c.j.a.i.p.v.b.l.ReadFileStepListener     : [] read-feed-file-step ended with status exitCode=COMPLETED;exitDescription= with compositeReadCount 1 and other count status as: BatchStatus(readCount=198, multiEntityAccountCount=0, readMultiAccountEntityAdjustment=0, accountFilterSkipCount=7, broadRidgeFilterSkipCount=189, writeCount=2, taskCreationCount=4)

我想在仪表板中显示上述日志中的所有整数值的统计信息。

编辑1：

我试过这个但没有工作。

index=abc xyz| rex field=string .*readCount=(?P<readCount>\d+)  | table readCount

标签： splunksplunk-query

Answer 1

我解决了这个问题

index=xyz |regex ".*fileName=(\s*([\S\s]+))" | rex field=string .*compositeReadCount=(?P<compositeReadCount>\d+)  |regex ".*readCount=(?P<readCount>\d+)" | regex ".*multiEntityAccountCount=(?P<multiEntityAccountCount>\d+)" | regex ".*readMultiAccountEntityAdjustment=(?P<readMultiAccountEntityAdjustment>\d+)" | regex ".*accountFilterSkipCount=(?P<accountFilterSkipCount>\d+)" | regex ".*broadRidgeFilterSkipCount=(?P<broadRidgeFilterSkipCount>\d+)" | regex ".*writeCount=(?P<writeCount>\d+)" | regex ".*taskCreationCount=(?P<taskCreationCount>\d+)" | regex ".*status=(\s*([\S\s]+))" | table _time fileName compositeReadCount readCount multiEntityAccountCount readMultiAccountEntityAdjustment accountFilterSkipCount broadRidgeFilterSkipCount writeCount taskCreationCount status