I have a event similiar to one below:
Server Status - ServerName - RUNNING
JMS Queue - ServerName : Module1!JMSServer1@QueueName1 , 0, 0, 13, 45, 0, 1345, 800
JMS Queue - ServerName : Module2!JMSServer1@QueueName2 , 0, 0, 3, 14, 0, 15, 800
JMS Queue - ServerName : Module3!JMSServer2@QueueName3 , 0, 0, 23, 24, 0, 13, 800
JMS Queue - ServerName : Module4!JMSServer3@QueueName4 , 0, 0, 25, 35, 0, 1, 800
JMS Bridge - ServerName:BridgeName1,Forwarding messages.
JMS Bridge - ServerName:BridgeName2,Forwarding messages.
This complete snippet is a single event.
This gets written onto a file at regular interval (JMS Queues and JMS Bridges status) which is monitored by splunk,and this complete thing is indexed as a single event with multiple lines,
Now i would like to extract info from this event and show in following table format in panel in dashboard
QueueName Field1 Field2 Field3 Field4 Field5 Field6 Field7
QueueName1 0 0 13 45 0 1345 800
QueueName2 0 0 3 14 0 15 800
QueueName3 0 0 23 24 0 13 800
QueueName4 0 0 25 35 0 1 800
You could build a field extraction for a every field or you could build one for the entire event. Below is a regex statement I've tested with your sample.
(?ms)(?P<queuename>[^\s@]+)\s,\s(?P<value1>[^\s,]+),\s(?P<value2>[^\s,]+),\s(?P<value3>[^\s,]+),\s(?P<value4>[^\s,]+),\s(?P<value5>[^\s,]+),\s(?P<value6>[^\s,]+),\s(?P<value7>[^\s,]+)$
Then you would append ...|queuename =
Or
...| chart span=5m avg(value4) as value by queuename.
I dont know what your trying to accomplish with your report or chart.
even if i do it, that complete thing being a single event.
If I need to extract details for only 1 queue say QueueName3.
I will get all the details for all Queues as it is a single event.