How to create a time series from a log file?

amdosh — Tue, 14 Jun 2022 21:46:25 GMT

I have a log file with a unique identifier (requestid) for a sequence of events. I want to show a breakup of all events within the requestid. I plan to show that by "marking" the start and stop logs of different events (based on the specific log message) I plan to track and finally create some table like this:

06/14/22 12:35:03.022 requestid=1requestid1 started
06/14/22 12:36:03.022 requestid=1 Event1 started
06/14/22 1237:03.022 requestid=1Event2 started
06/14/22 12:38:03.022 requestid=1 Event2 ended
06/14/22 12:39:03.022 requestid=1 Event1 ended
06/14/22 12:40:03.022 requestid=1requestid1 ended

Re: How to create a time series from a log file?

amdosh — Tue, 14 Jun 2022 22:11:38 GMT

I think the best solution for me would be to modify the logs to have something like below and use transaction on the new tracker field.

06/14/22 12:35:03.022 requestid=1 requestid1 started
06/14/22 12:36:03.022 requestid=1 tracker=Event1 started
06/14/22 1237:03.022 requestid=1 tracker=Event2 started
06/14/22 12:38:03.022 requestid=1 tracker=Event2 ended
06/14/22 12:39:03.022 requestid=1 tracker=Event1 ended
06/14/22 12:40:03.022 requestid=1 tracker=requestid1 ended

topic Re: How to create a time series from a log file? in Splunk Search

How to create a time series from a log file?

Re: How to create a time series from a log file?