topic Re: Extract fields from log message in Splunk Search

Extract fields from log message

parameshjava — Fri, 05 May 2017 00:10:49 GMT

I used AOP concept to track few methods execution time and it will print the log as follows :

Execution Time : [method Name, time] : getProfiles, 1631
Execution Time : [method Name, time] : getAddress, 1500
Execution Time : [method Name, time] : getReports, 100

Is there any way to generate table/chart for each entry in log as follows:

Method Nane | Time
getProfile |1631
getAddress |1500
getReports | 100

Re: Extract fields from log message

cpetterborg — Fri, 05 May 2017 00:36:50 GMT

Try this:

_your_search_ | rex "] : (?P<MethodName>[^,]*),\s*(?P<Time>\d*)" | table MethodName, Time

Then you can select a visualization from the Visualization tab in the interface.

Re: Extract fields from log message

parameshjava — Fri, 05 May 2017 06:17:35 GMT

Thanks a lot, its perfectly worked.