Reporting

Reporting on multiple fields

rjyetter
Path Finder

I'm trying to create a report off of 20 or so fields. The data set looks like the following:
{EVENTS_MONITORING_COUNT = {PUSH_NOTIFICATIONS_USING_PROVIDERS_DISABLED=0, MEMCACHED_KEY_TOO_LONG=0, EVENT_THROTTLER_TOTAL_THROTTLED_EVENTS=0, EVENT_THROTTLER_TOTAL_PROCESSED_EVENTS=0, EVENT_THROTTLER_NEW_MSG_BLEH_POSTS_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLEH_POSTS_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM_PROCESSED=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_NON_SUPPORTED_EVENT=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_MEMCACHE_LOOKUP_ERROR=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_INVALID_COURSE_ID=0, EVENT_CALLBACK_TYPE_NOT_SLECTED=0, EVENT_CALLBACK_THREAD_EXECUTOR_BLOCKING_QUEUE_FULL=0, EVENT_CALLBACK_PROFILE_ID_NULL=0, EVENT_CALLBACK_NO_BLEHS_IN_STUFF_TEAM=0, EVENT_CALLBACK_NO_PROFILE_ID_FOR_THIS_IRN=0, EVENT_CALLBACK_NO_FORUMS=0, EVENT_CALLBACK_NO_DEVICES_FOR_USER=0, EVENT_CALLBACK_NO_CLASSES_FOR_COURSE_CODE=0, EVENT_CALLBACK_NO_ACTIVE_COURSES=0, EVENT_CALLBACK_MULTIPLE_CLASSES_FOR_COURSE_CODE=0, EVENT_CALLBACK_MOBILE_DEVICE_NOT_FOUND=0, EVENT_CALLBACK_INVALID_PAYLOAD=0, EVENT_CALLBACK_EXCEPTION=0, EVENT_CALLBACK_ET_USER_REMOVES_POST=0, EVENT_CALLBACK_ET_USER_READS_UNREAD_POST=0, EVENT_CALLBACK_ET_USER_MARKS_POST_AS_UNREAD=0, EVENT_CALLBACK_ET_USER_MARKS_ENTIRE_THREAD_AS_READ=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_RESPONDS_TO_YOUR_POST_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_NEW_THREAD_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_IN_STUFF_TEAM=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_IN_INDIVIDUAL_FORUM=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS=0, EVENT_CALLBACK_ET_NEW_MSG_OTHER=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM=0, EVENT_CALLBACK_ET_INVALID_EVENT_TYPE=0, EVENT_CALLBACK_ET_BLAH_GRADED_ASSIGNMENT_SCORE_POSTED=0, EVENT_CALLBACK_ET_DUPLICATE_DELIVERY=0, EVENT_CALLBACK_DEVICE_TOKEN_NULL=0, EVENT_CALLBACK_DEVICE_ID_NULL=0, EVENT_CALLBACK_CLASS_NOT_FOUND_AS_ACTIVE=0, EVENT_CALLBACK_CLASS_NOT_FOUND=0, APNS_PAYLOAD_TOO_BIG=0}}

So I want to build a report based on EVENT_*=x. The fields are defined but I cannot just do a wildcard on fields. Is there an efficient way of reporting on multiple fields within the same event log?

Thanks,

Rick

Tags (1)
0 Karma

rjyetter
Path Finder

Got it figured out in a very ugly manner - |timechart max(Event Name), max (Event Name2), max (event Name 3) etc.. etc.. This got the results that were needed - It is actually very useful when our developers who've embraced Splunk are now enhancing their code to be able to log specific events.

0 Karma

Ayn
Legend

Ok, but HOW do you want to report them? The stats command supports wildcards - what are you trying to do that isn't working?

0 Karma

rjyetter
Path Finder

This is a single log entry that summarizes the number of events within a specific application. So each log entry will have this summarization. So I just want to report on all fields and their subsequent values in a nice chart -

0 Karma

kristian_kolb
Ultra Champion

Is this an example of a single event? Or is it a list of the possible events that may occur? Please post a few sample events, and be a bit more precise on what type of report you would like to construct.

/k

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...