How do I parse through my sample CSV type log to graph field values by date?

danielpa — Fri, 03 Jun 2016 19:31:27 GMT

Hi,

I am having trouble finding a good way of parsing through my log entries to try and grab the key-value pairs for plotting on a graph.

To be clear, I get one log a day in the format:

2016-06-03 05:00:00 date=201606030000 [Audit Report],ad=998,adExtension=0,adGroup=160,adunit=0,advertiser=0,advertiserFunds=0,app=0,bidModifier=0,campaign=0,control=0,dataDictionary=1,demandDefinition=0,forexVersion=0,fundTransaction=0,publisher=0,section=0,site=0,summary=0,supplyDefinition=0,targetingAttribute=3682,trackingPixel=0

I want to generate a graph where I have a line graph
x-axis = Date
y-axis = value

I want a line representing the value for each key for each date so that I can observe the trends for each key (i.e. the ad, adExtension, adunit, etc.)

However, I'm having trouble finding a good way of filtering out only the bolded section in the example log so that I can use it for graphing. I also have the flexibility of changing the format of my log if that would be the best solution.

Help is greatly appreciated.
Thanks!

Re: How do I parse through my sample CSV type log to graph field values by date?

somesoni2 — Fri, 03 Jun 2016 21:10:54 GMT

Assuming that Splunk is able to parse the timestamp which is at the start of event and setting _time field with that, then try this

your base search | _time ad* app bid...listall available fields ... | timechart span=1d values(*) as *

topic Re: How do I parse through my sample CSV type log to graph field values by date? in Getting Data In

How do I parse through my sample CSV type log to graph field values by date?

Re: How do I parse through my sample CSV type log to graph field values by date?