topic extract different models by audio and vedio type per day in Splunk Search

extract different models by audio and vedio type per day

splunkuseradmin — Tue, 29 Sep 2020 23:45:17 GMT

Hello Everybody,

I would like some help in sorting out different models with same kind and showing in a chart with type audio vs video for time span=1d.
my fields looks something like this.

_time callMediaType devicetype
3/17 13:12:23 audio CSF123
-------------------------- TCT312

3/17 15:17:20 audio. TCT321
--------------------------- SEP432
3/18 12:15:13. video. TAB123
----------------------------CSF145
3/18 14:23:12 audio. AMR-23-11XX-SIP
----------------------------TAB343
3/18 17:23:11 video. TCT231
----------------------------AMR-42-12XX-sip
3/19 12:23:14 audio. SEP073
----------------------------CSF678

Note:- where in 1st event shows in device type (callingpartydevice=CSF123 to calledpartydevice=TCT312).

I only need CSF*,TCT*,TAB* models from device_type.

I need time chart per day with separate audio chart vs video chart with devicetypes (CSF,TCT,TAB) only.
I also can do multi-series mode to compare audio and video.

Re: extract different models by audio and vedio type per day

adonio — Mon, 18 Mar 2019 00:40:52 GMT

can you kindly elabore?
i am not clear as to how your data looks like and what: "1st event shows in device type (callingpartydevice=CSF123 to calledpartydevice=TCT312)." means
in general, you can do something like this:
... your search ... (device_type=CSF* OR device_type=TCT* OR device_type=TAB*) | timechart span=1d count as event_count by device_type

hope it helps

Re: extract different models by audio and vedio type per day

splunkuseradmin — Mon, 18 Mar 2019 05:07:30 GMT

these are the fields till where i have reach with logs.
this point i have these fields in my table, so i need to make a timechart using this by extracting needed data and making either statcked bar chart or individual chart by showing audio vs video for those particular models only.