topic Re: splunk search in Splunk Search

splunk search

sriva6 — Thu, 27 Dec 2012 19:04:10 GMT

Hi,

I have application logs which read something like this
Blah bla blah File Descriptor: 1234
Blah bla blah File Descriptor: 5678
.
.
.

I have added the log file data to my spunk server and now I want to use splunk to get a trend of the number of file descriptors in a chart. I do not want the number of times the string "file descriptors" appaears in the logs instead i want the value of the file descriptor. Please let me how can I do this?

Re: splunk search

lguinn2 — Thu, 27 Dec 2012 19:51:50 GMT

Try this

yoursearchhere
| rex "File Descriptor:\s(?<fileDescriptor>\S+)"
| timechart count by fileDescriptor

yoursearchhere
| rex "File Descriptor:\s(?<fileDescriptor>\S+)"
| chart count by fileDescriptor

The rex command creates a field called fileDescriptor that can be used in the commands that follow in the pipeline.

Re: splunk search

reed_kelly — Thu, 27 Dec 2012 20:01:40 GMT

You can either parse the file descriptor in props.conf or use the rex command to parse it in the search. For example, if you are trying to get a time chart of the number of distinct file descriptors used in each hour, then you could use something like the following:

index=xxx ... |rex field=_raw "File\sDescriptor:\s+(?<file_descriptor>\d+)" |timechart span=1h dc(file_descriptor)

Of course, this has to be used in a chart of some sort.

Re: splunk search

sriva6 — Fri, 28 Dec 2012 12:30:51 GMT

hi,

I tried this but this is giving me a count of the number of times a particular Field Descriptor value appears in the logs but I want to get the list of all the field descriptor values in the logs and plot a graph/chart to show the trend of the descriptors over a time

Re: splunk search

jangid — Fri, 28 Dec 2012 14:42:27 GMT

try

| chart values(fileDescriptor)