topic timechart "method name duration over time" in Splunk Search

timechart "method name duration over time"

indeed_2000 — Tue, 15 Jun 2021 10:44:03 GMT

Hi I have log file like this:

2021-06-15 13:39:47,762 INFO [APP] Exiting method , duration[109] User: general || method: findTypeMaps started at [1623748187753]
2021-06-15 13:39:47,738 INFO [APP] Exiting method , duration[101] User: general || method: findString started at [1623748187728]
2021-06-15 13:39:47,738 INFO [APP] Exiting method , duration[121] User: general || method: collectName started at [1623748187728]

I want to create chart that show method name duration over time on chart that able me to select method name.

like this:

Re: timechart "method name duration over time"

ITWhisperer — Tue, 15 Jun 2021 10:38:01 GMT

Try this

| rex "duration\[(?<duration>\d+)\].*?method:\s(?<method>[^\s]+)" | xyseries _time method duration

Re: timechart "method name duration over time"

indeed_2000 — Tue, 15 Jun 2021 11:49:15 GMT

Thank you for reply, it work for first part of my question.

but how can I show list of method on dashboard that when user select them just show that method on chart?

Thanks,

Re: timechart "method name duration over time"

ITWhisperer — Tue, 15 Jun 2021 11:58:41 GMT

Depends on how you want to select the method and how you want that to affect what is on the chart. You could have a dropdown which is populated by a search query and sets a token that is used as a filter on the search for the chart, or you could have a table with similar information and use a drilldown from the table to set the token for the filter. If you want to do it the other way around i.e. click on the chart and drilldown to set a token to change what is displayed in a table.

Re: timechart "method name duration over time"

indeed_2000 — Tue, 15 Jun 2021 15:35:11 GMT

I don't familiar with tokens, would you please tell me simple example?

another problem is, when I set time scope "real-time" (from 5min to NOW) it will be freeze for while, after that show chart. Is it possible reducing data points on chart. For e.g instead of show 1000 duration points on each minute for one method, just show one point that average of all those 1000 duration points.

is it possible to do this more efficient?