Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to monitor a multi line log with a variable number of field value pairs?

$
0
0
We monitor the log output of many file storage systems, some devices have only a few, others have hundreds, but there is no way of knowing how many disks each log file will contain. The issue (in the real world) is that the customer has 2 non compatible drives; the `750gb` HDD part code `HRF750`. We want to be able to extract on the full line `750gb HDD partnumber: HRF750 s/n: 31564847877` from the log where ever we find the part code `HRF750`. We can then put this in a table or report, allowing us to find systems running on compatible hardware. How do I go about doing this? Below is an example of what a log file looks like. Array model: RX-100 250gb SSD partnumber: XFA250 s/n: 12313123123 250gb SSD partnumber: XFA250 s/n: 56498787521 250gb SSD partnumber: XFA250 s/n: 95195195198 250gb SSD partnumber: XFA250 s/n: 51515151511 250gb SSD partnumber: XFA250 s/n: 95959595959 750gb HDD partnumber: HRF750 s/n: 31564847877 750gb HDD partnumber: HRF750 s/n: 89765432145

Viewing all articles
Browse latest Browse all 47296


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>