Every hour, we have a group of devices that send out a similar log:
Feb 16 03:01:00 DeviceNameA.domain.com 2014-02-16 03:01:00 - DeviceNameA - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 35
Feb 16 03:01:00 DeviceNameB.domain.com 2014-02-16 03:01:00 - DeviceNameB - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 68
Feb 16 03:01:00 DeviceNameC.domain.com 2014-02-16 03:01:00 - DeviceNameC - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 170
My goal is to build a dashboard that lists all the devices and how many users are currently logged in (for the past hour), then add all 24 hours up for the past day, then add all the days up for the past week, then all the weeks up for the past month, etc...
Brand new to splunk. I think what I am trying to do is turn the string of text "Number of concurrent users logged in to the device:" into a field and then I will be able run a report on that field, then add that report to a dashboard.
After a few hours of muddeling through the field extraction tool, I never got the expected result in the tool, but I was able to generate a query based on the regex it gave me. see below.
"concurrent users logged in to the device" | rex field=_raw "search.(?i)^(?:[^-]*-){9}\s+(?P \w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+:)"
Does this mean I now have a field called ConcurrentUsers in this particular query? When I run the query, splunk highlights "concurrent users logged in to the device" like I would expect and does not return an error. Now what? 🙂
... View more