topic Re: sorting based on value? in Splunk Search

sorting based on value?

tinhuty — Wed, 27 Apr 2011 02:28:33 GMT

one of my log file has this key-value: pageLoadTime=xxx, where xxx is number of milliseconds.

how do I write the search to sort by xxx, so the biggest pageLoadTime is on the top? I tried "|top pageLoadTime" but that sort by number of occurence of xxx.

thanks.

Re: sorting based on value?

herbie — Wed, 27 Apr 2011 05:01:17 GMT

On the end of your search, add the sort function. Eg:

... | sort -pageLoadTime

Cheers.

Re: sorting based on value?

tinhuty — Wed, 27 Apr 2011 15:03:43 GMT

Thanks very much herbie, that works, now the4 eventdata are sorted by pageLoadTime. My log data also has timestamp, the simplified sample log entry is like:

[04/26/2011 14:03:27,832][DEBUG]:page=Order.aspx, pageLoadSeconds=0.1093687

Is there command to make it a chart, with pageLoadTime as Y-axis and timestamp as X-axis? what will be very helpful to see exactly when those slow pageload happened.

I just started using couple days ago that there are lots of commands I need to learn.

Re: sorting based on value?

herbie — Wed, 27 Apr 2011 23:25:44 GMT

Yes, there is a couple of ways you can do this. Note that your timestamp gets put into a field called _time.

If you want to use average figures over a timerange, you can use the timechart function. Eg:

search command | timechart avg(pageLoadSeconds) as AvgPageLoadTime

If for some reason you want to graph the raw values of pageLoadSeconds, you can just create a table with the values you want, eg:

search command | table _time, pageLoadSeconds

Note, the graphs in Splunk will only plot up to 1000 events, so if you use the table option you won't be able to do it over a lot of data. It's recommended to use timechart.

Either of these can be used to populate a Splunk graph.

Cheers,
Herbie.