topic extract fields and plot graphs based on the field values in Dashboards & Visualizations

extract fields and plot graphs based on the field values

muraliv — Tue, 02 Apr 2013 14:05:32 GMT

scenario:

have pushed snmp poll data as an event to splunk as a TCP source.
event format = "parameterId=paramterValue"
event source = SNMPTCP

to-do: need to find minute average of "parameterValue" for a particular "parameterId"

sample event data:

Timestamp event data

5:44:13.000 PM 908=51

5:43:58.000 PM 908=14

5:43:47.000 PM 908=18

5:43:36.000 PM 908=49

5:43:25.000 PM 908=88

5:43:14.000 PM 908=80

5:42:58.000 PM 908=98

5:42:47.000 PM 908=55

5:42:36.000 PM 908=43

5:42:20.000 PM 908=13

when given as a minute wise report

search query - "sourcetype="SNMPTCP" | timechart span 1m count"

5.42 - 4

5.43 - 5

5.44 - 1

but to calculate the parameterValue as follows,

5.42 - ( 13 + 43 + 55 + 98 ) / 4 = 52

5.43 - ( 14 + 18 + 49 + 88 + 80 ) / 5 = 49.8

5.44 - 51 / 1 = 51

what is the query to be executed. i tried extract command but in vain. A sample command will be really helpful.

thanks in advance.

gfuente — Tue, 02 Apr 2013 14:16:06 GMT

Hello

First you´ll need to extract the values with, rex command, something like:

... | rex field=_raw "  908=(?<myvalue>\d+)" | ...

Then you should have a new field to use called "myvalue" and then you only need to make a search like:

sourcetype="SNMPTCP" | timechart span 1m avg(myvalue)

So combining both:

sourcetype="SNMPTCP" | rex field=_raw="  908=(?<myvalue>\d+)"| timechart span 1m avg(myvalue)

Regards

muraliv — Wed, 03 Apr 2013 06:07:05 GMT

thanks for the prompt reply gfuente.

muraliv — Thu, 04 Apr 2013 12:36:20 GMT

gfuente,
is it possible to achieve the same result by using kv/extract command instead of rex?
if possible please share.