topic Re: How to query key values and draw timechart? in Getting Data In

How to query key values and draw timechart?

pavan257 — Sat, 18 Jul 2015 23:56:29 GMT

Here is the sample data.

RED: 2086
GREEN: 1579
WHITE: 159
PINK: 348
ORANGE: 0

Re: How to query key values and draw timechart?

woodcock — Sun, 19 Jul 2015 05:28:42 GMT

Is this 1 event or 5?

Re: How to query key values and draw timechart?

pavan257 — Sun, 19 Jul 2015 13:33:19 GMT

This was one event.

Re: How to query key values and draw timechart?

rsennett_splunk — Sun, 19 Jul 2015 21:34:12 GMT

does your event have a timestamp? Do all the events contain all those fields? Just those fields? more? Less?

Re: How to query key values and draw timechart?

pavan257 — Sun, 19 Jul 2015 22:21:35 GMT

Yes, I do have time stamp and all the events will have all these fields with different values.

Re: How to query key values and draw timechart?

woodcock — Sun, 19 Jul 2015 22:45:01 GMT

This should do it:

...  | rex max_match=0 field=raw "(?<lineData>[^:]+:\s*\d+)" | mvexpand lineData | rex field=lineData "(?<color>[^:]+):\s*(?<count>\d+)" | timechart span=1h sum(count) AS count BY color

This makes your X-axis interval 1 hour.

Re: How to query key values and draw timechart?

pavan257 — Sun, 19 Jul 2015 23:59:54 GMT

No. this query just displaying the events but not the visualization, all these events come through a custom shell script which we made output as "sourcetype = weblogic_stdout" not sure, if that matters here.

Re: How to query key values and draw timechart?

MuS — Mon, 20 Jul 2015 00:04:18 GMT

After you run the search, in the UI click on the Visualization tab and create what ever visualization you need.....

Re: How to query key values and draw timechart?

pavan257 — Mon, 20 Jul 2015 00:10:48 GMT

I know, but this query was not representing any timechart to visualize.

Re: How to query key values and draw timechart?

woodcock — Mon, 20 Jul 2015 02:43:25 GMT

You are going to have to replace ... with your base search. I tested this on your sample data: it works just fine.

Re: How to query key values and draw timechart?

pavan257 — Mon, 20 Jul 2015 23:38:25 GMT

...  | rex max_match=0 field=_raw "(?[^:]+:\s*\d+)" | mvexpand lineData | rex field=_raw "(?[^:]+):\s*(?\d+)" | timechart span=1h sum(count) AS count BY color

with this query I am able to see only "RED", but I want to see other lines (GREEN, WHITE...) to be charted.

Re: How to query key values and draw timechart?

pavan257 — Tue, 21 Jul 2015 01:54:54 GMT

After further cleanup of y event.. this worked perfectly. Thanks Woodcock.