Hello!
I am receiving logs from SNMP, but the field names are incremental in nature, which have the same values as the incremental value. For an example:
oid_hierarchy_value_1 = 1
oid_hierarchy_value_2 = 2
oid_hierarchy_value_3 = 3
How can I go about extracting these fields from the logs so that I can do chart sum, average, and so on?
+3
Hello Sandesh,
The incremental values are the child object values under the same parent object.
You can use a query like;
“ | rex oid_hierarchy_value_\d+\s=\s(?P<object_id>) | rename object_id as object_name | chart sum(object_name) by device_name“
or
“ | rex oid_hierarchy_value_(?P<object_id:int>) | rename object_id as object_name | chart avg(object_name) by device_name“
You can extract the required value through rex or norm lookup. Then use it as per your requirement in the form of sum, average, count, max, min and so on.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
