Time chart on object property

larryluckland — Thu, 30 Sep 2021 15:00:35 GMT

I'm new to Splunk and I'm trying to do something that is probably basic but I haven't been able to figure out how to do it.

I have a log in Splunk which contains an http_query along the lines of:

```

my_object[prop1]=someVal&my_object[prop2]=someOtherVal

```

I'm trying to use a timechart to inspect these values. I've tried:
`timechart count by my_object[prop1]` which tells me prop1 is undefined.

Then also tried

`timechart count by my_object.prop1` which gives me a time series with NULL everywhere.

How can I do this?

Re: Time chart on object property

somesoni2 — Thu, 30 Sep 2021 15:43:37 GMT

Run a basic search (without timechart) in "Smart Mode" and see what fields are being extracted by Splunk (field sidebar appears on left on "Events" tab). If your http_query fields are extracted, then use the exact name in timechart as they appear in field sidebar.

topic Time chart on object property in Dashboards & Visualizations

Time chart on object property

Re: Time chart on object property