topic Re: How to create a timechart with actual values (NOT aggregation) in Splunk Search

How to create a timechart with actual values (NOT aggregation)

chandukreddi — Thu, 26 Mar 2020 17:03:14 GMT

Hello Team,

from below words I would like to get only value 497 and that has to be timechart with actual value, how do I do that?

G1 Young Generation GC in 497ms.

Log print:

WARN [Service Thread] 2020-03-26 16:45:30,391 GCInspector.java:282 - G1 Young Generation GC in 497ms. G1 Eden Space: 683671552 -> 0; G1 Old Gen: 2290144840 -> 2009072128; G1 Survivor Space: 67108864 -> 62914560;

Re: How to create a timechart with actual values (NOT aggregation)

richgalloway — Thu, 26 Mar 2020 17:30:09 GMT

Extract the value using rex.

... | rex "GC in (?<GCtime>\d+)"

Use the values function to display all GCtime values that were seen in the given interval.

... | timechart span=1s values(GCtime) as GCtime by host

Re: How to create a timechart with actual values (NOT aggregation)

chandukreddi — Thu, 26 Mar 2020 18:58:57 GMT

great it works!

But we have multiple hosts, so I would like to get individual line per Host. can you please help me?

Re: How to create a timechart with actual values (NOT aggregation)

richgalloway — Fri, 27 Mar 2020 00:27:48 GMT

See the updated answer.