topic Combining charts from different searches in Splunk Search

Combining charts from different searches

attgjh1 — Fri, 08 Jun 2012 06:06:14 GMT

im using something like this:

sourcetype="A" category="CatA" "msg string in my log not stored as a field" | timechart span=1h count(_raw)

this gives me a single charted line which tracks occurrences of that particular log with string specified. I hav several of such lines. However is there a way to save each of this 'search' under a single name so that i can combine them into a single chart?

im not sure if this is possible (i suspect it has to do with eval)? any tips?

EDIT:

Event looks like this:

6/27/2011 3:47:02 AM    6/27/2011 3:47:02 AM    pss2wlsfe2b [ps2wseb] PS.RR.SV.APP Full GC detected in log file [directory/gc.log] line [254988] (5 occurrences since 11:42:01) CLOSED  WARNING App

so basically, from "Full GC detected in log file [directory/gc.log] line 254988"
they are replacable by the following messages as well.

Warn:Full GC detected in log file line 3

Memory high after full GC (90.19%/90%, next threshold 95%)

Err:Memory high after full GC (80%/75%, next threshold 80%)

basically im looking out for almost the entire main phrase:

"full gc detected in log file"

"memory high after full gc"

"err:memory high after full gc"

to see if they occur at the same time or over diff periods of time

Re: Combining charts from different searches

kristian_kolb — Fri, 08 Jun 2012 07:20:48 GMT

I would say that this is possible with rex, i.e. extracting fields on the fly, but it's pretty dependant on how the events are formatted. My idea for doing this is;

sourcetype=A category=CatA "string no 1" OR "string no 2" OR "string no 3" 
| rex "blaha (?<my_string>(string no 1 | string no 2 | string no 3)) blaha" 
| timechart span=1h count by my_string

Please post a few sample messages to be able to get better help.

From your ONE sample, it's hard to tell the general pattern of the possible log messages, but here's a shot at extracting the interesting string as a field;

sourcetype=A category=CatA | rex "\[\w+\]\s[A-Z.]\s(?<msg_string>[\s\w:]+)" | timechart c by msg_string

If you have a lot of events that do not contain a msg_string, you could insert a search msg_string=* after the rex, but before the timechart/stats/whatever function.

Kristian

Re: Combining charts from different searches

attgjh1 — Fri, 08 Jun 2012 08:02:17 GMT

updated.
;)

Re: Combining charts from different searches

kristian_kolb — Fri, 08 Jun 2012 10:39:00 GMT

Full events, please 🙂

Just mask any sensitive stuff, ip-addresses, accounts etc.

Re: Combining charts from different searches

attgjh1 — Mon, 11 Jun 2012 00:48:10 GMT

ok.
thanks for the help so far! 🙂