topic Extract a specific value and make a visualization with time in Splunk Search

Extract a specific value and make a visualization with time

john_snow00 — Tue, 17 Oct 2023 10:05:12 GMT

I have regular traffic passing through my server. The server has the IP 10.41.6.222

My goal is to extract the Rate /sec passing through the server and to be able to see theRate /sec in a graph an having x asis showing time and y axis Rate /sec (extracted values).

-----------------------------------------------------------------------------------------------------------------------------------

Rate 0/sec : Bytes 9815772 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 402/sec : Bytes 9816135 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 139587/sec : Bytes 10004146 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 147636/sec : Bytes 10009645 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 69967/sec : Bytes 10358668 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 69967/sec : Bytes 10361672 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 69967/sec : Bytes 10364579 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 69967/sec : Bytes 10364667 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 49661/sec : Bytes 10371887 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 217793/sec : Bytes 10700517 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 353829/sec : Bytes 10944230 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 93689/sec : Bytes 10946290 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 82030/sec : Bytes 10950753 : from owa client to vs_owa with address

Re: Extract a specific value and make a visualization with time

gcusello — Tue, 17 Oct 2023 10:48:08 GMT

Hi @john_snow00,

sorry, where is the timestamp?

if it isn't contained in the event, it's added by Splunk.

Anyway, you could run something like this:

<your_search> | rex "Rate\s+(?<Bytes>\d+)\/sec" | eval MB=Bytes/1024/1024 | timechart sum(MB) AS MB

I also added the regex to extract the field, if you already have it, don't use my regex.

Ciao.

Giuseppe

Re: Extract a specific value and make a visualization with time

john_snow00 — Tue, 17 Oct 2023 13:09:58 GMT

Thank you Giuseppe. Can you please explain line after line ?

Re: Extract a specific value and make a visualization with time

gcusello — Tue, 17 Oct 2023 13:19:44 GMT

Hi @john_snow00,

I try to explain:

<your_search> --- it's your search, e.g. index=your_index sourcetype=your_sourcetype --- | rex "Rate\s+(?<Bytes>\d+)\/sec" --- Bytes field extraction --- | eval MB=Bytes/1024/1024 --- change measure of Bytes field from bytes to MB ---- | timechart sum(MB) AS MB --- sum of the traffic foe time periods, it's possible to define this span period ---

Ciao.

Giuseppe

Re: Extract a specific value and make a visualization with time

john_snow00 — Tue, 17 Oct 2023 13:43:06 GMT

Thank you for the explanation. The rate in seconds you see above are produced by Loadbalancer upon incoming TCP requests. The logs are later pushed to splunk for analysis.

I d'ont want to carry any futher calculation. I just want to extract the rate /sec from the raw and present it upon time (x-axis).