How to make dashboard for the different events with the help of extraction

[sunnyparmar]

I have logs here given below in which there are different companies like wienerberger_de, veolia-uk, XeroxFinland_fi, Crown_Korea and EnergyDrilling_sg etc..etc.... so now i have to make one dashboard in which I can see the data with company name and the file type that whether it is coming in .pdf, .txt or .tif format. So anybody can give advise on this?

My current query didn't give the exact result. It is giving data in two columns.. one is timeframe and other is null. In null column it is showing counts but when i am clicking on counts so it is showing "no result found".

index="abc" sourcetype="xyz" | rex "c:/bscs/(?<sc_partner>(\w|-|\s)+)/(?<sc_customer>(\w|-|\s)+)" | timechart span=1h count by sc_customer


TIMESTAMP - [2015-09-21 10:14:12.576]   THREAD ID - [48]    CONTENT - File Archived C:\BSCS\wienerberger_de\BSCSEmail\20150921_101351_WIENERBERG_EMAIL_1442819631609.PDF
TIMESTAMP - [2015-09-21 10:14:12.311]   THREAD ID - [37]    CONTENT - File Archived C:\BSCS\veolia-uk\BSCSEmail\20150921_101005_VEOLIAEMAI_EMAIL_1442819405339.PDF
TIMESTAMP - [2015-09-21 10:08:30.553]   THREAD ID - [42]    CONTENT - File Archived C:\BSCS\XeroxFinland_fi\destia_fi\pl801e_destiamaansiirto_000\upload\20150921_093331_DESTI0801FI_20150921000003_000028.tif
TIMESTAMP - [2015-09-21 10:08:09.365]   THREAD ID - [42]    CONTENT - File Archived C:\BSCS\Crown_Korea\daimler_kr\daimler_8524\WF00194\upload\20150921_1515_DAIMLER852400003KR_8524194_00001.tif
TIMESTAMP - [2015-09-21 10:08:09.255]   THREAD ID - [42]    CONTENT - File Archived C:\BSCS\Crown_Korea\daimler_kr\daimler_8524\WF00111\upload\summary_DAIMLER852400003KR_20150921_1510.txt
TIMESTAMP - [2015-09-21 10:02:36.537]   THREAD ID - [48]    CONTENT - File Archived C:\BSCS\EnergyDrilling_sg\extracts_upload\OrderExtract.txt

Thanks

[sunnyparmar]

Thanks for replying. it has one problem while i am searching with your query that is one of my log is like given below

TIMESTAMP - [2015-09-21 10:13:43.169] THREAD ID - [3] CONTENT - Database Logged for File: C:\BSCS\AMFI_NO\BSCSEmail\20150921_101302_PDFINVOICE_EMAIL_1442819582465.PDF DatabaseServer: 10.xxx.xxx.50

so in final output in filetype column with .pdf, .txt and .tif file types I am getting 50 also and showing count against it. I think it is taking database server ip that i have mentioned in above given logs so could you please suggest that how to remove this field or else how to collaborate this field with the other company related fields. Thanks

[somesoni2 · Accepted solution]

Try something like this

index="abc" sourcetype="xyz" | rex "C:\\\\BSCS\\\\(?<sc_partner>(\w|-|\s)+)\\\\(?<sc_customer>[^\/]+).*\.(?<FileType>\w+)$" | stats count by sc_partner FileType

[sunnyparmar]

Well I have sorted out the problem hence closing this question.. thanks