I'm trying to create a report off of 20 or so fields. The data set looks like the following:
{EVENTS_MONITORING_COUNT = {PUSH_NOTIFICATIONS_USING_PROVIDERS_DISABLED=0, MEMCACHED_KEY_TOO_LONG=0, EVENT_THROTTLER_TOTAL_THROTTLED_EVENTS=0, EVENT_THROTTLER_TOTAL_PROCESSED_EVENTS=0, EVENT_THROTTLER_NEW_MSG_BLEH_POSTS_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLEH_POSTS_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM_PROCESSED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM_SKIPPED=0, EVENT_THROTTLER_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM_PROCESSED=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_NON_SUPPORTED_EVENT=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_MEMCACHE_LOOKUP_ERROR=0, EVENT_THROTTLER_DID_NOT_PROCESS_EVENT_INVALID_COURSE_ID=0, EVENT_CALLBACK_TYPE_NOT_SLECTED=0, EVENT_CALLBACK_THREAD_EXECUTOR_BLOCKING_QUEUE_FULL=0, EVENT_CALLBACK_PROFILE_ID_NULL=0, EVENT_CALLBACK_NO_BLEHS_IN_STUFF_TEAM=0, EVENT_CALLBACK_NO_PROFILE_ID_FOR_THIS_IRN=0, EVENT_CALLBACK_NO_FORUMS=0, EVENT_CALLBACK_NO_DEVICES_FOR_USER=0, EVENT_CALLBACK_NO_CLASSES_FOR_COURSE_CODE=0, EVENT_CALLBACK_NO_ACTIVE_COURSES=0, EVENT_CALLBACK_MULTIPLE_CLASSES_FOR_COURSE_CODE=0, EVENT_CALLBACK_MOBILE_DEVICE_NOT_FOUND=0, EVENT_CALLBACK_INVALID_PAYLOAD=0, EVENT_CALLBACK_EXCEPTION=0, EVENT_CALLBACK_ET_USER_REMOVES_POST=0, EVENT_CALLBACK_ET_USER_READS_UNREAD_POST=0, EVENT_CALLBACK_ET_USER_MARKS_POST_AS_UNREAD=0, EVENT_CALLBACK_ET_USER_MARKS_ENTIRE_THREAD_AS_READ=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_RESPONDS_TO_YOUR_POST_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_NEW_THREAD_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_IN_STUFF_TEAM=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS_IN_INDIVIDUAL_FORUM=0, EVENT_CALLBACK_ET_NEW_MSG_BLEH_POSTS=0, EVENT_CALLBACK_ET_NEW_MSG_OTHER=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_RESPONDS_TO_YOUR_POST_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_NEW_THREAD_IN_MAIN=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_IN_STUFF_TEAM=0, EVENT_CALLBACK_ET_NEW_MSG_BLAH_POSTS_IN_INDIVIDUAL_FORUM=0, EVENT_CALLBACK_ET_INVALID_EVENT_TYPE=0, EVENT_CALLBACK_ET_BLAH_GRADED_ASSIGNMENT_SCORE_POSTED=0, EVENT_CALLBACK_ET_DUPLICATE_DELIVERY=0, EVENT_CALLBACK_DEVICE_TOKEN_NULL=0, EVENT_CALLBACK_DEVICE_ID_NULL=0, EVENT_CALLBACK_CLASS_NOT_FOUND_AS_ACTIVE=0, EVENT_CALLBACK_CLASS_NOT_FOUND=0, APNS_PAYLOAD_TOO_BIG=0}}
So I want to build a report based on EVENT_*=x. The fields are defined but I cannot just do a wildcard on fields. Is there an efficient way of reporting on multiple fields within the same event log?
Thanks,
Rick
Got it figured out in a very ugly manner - |timechart max(Event Name), max (Event Name2), max (event Name 3) etc.. etc.. This got the results that were needed - It is actually very useful when our developers who've embraced Splunk are now enhancing their code to be able to log specific events.
Ok, but HOW do you want to report them? The stats command supports wildcards - what are you trying to do that isn't working?
This is a single log entry that summarizes the number of events within a specific application. So each log entry will have this summarization. So I just want to report on all fields and their subsequent values in a nice chart -
Is this an example of a single event? Or is it a list of the possible events that may occur? Please post a few sample events, and be a bit more precise on what type of report you would like to construct.
/k