topic Re: Pulling data from table in Splunk Search

Pulling data from table

AlexMcDuffMille — Tue, 05 Nov 2013 14:55:36 GMT

hello,

I'm looking to make a panel that has 9 timechart lines on it.

I would like to graph the depth vs. time for each queue. Each log will create 1 data point for each queue. I'm thinking I need to use xmlkv or multikv or something similar to that, but can't seem to figure it out. Any ideas?

An example of the log is shown below:

> [2013.11.05-08:43:24.787]Output Response:
>     Queue:1 Depth=0; Oldest=0
>     Queue:2 Depth=0; Oldest=0
>     Queue:3 Depth=0; Oldest=0
>     Queue:4 Depth=0; Oldest=0
>     Queue:5 Depth=0; Oldest=0
>     Queue:6 Depth=0; Oldest=0
>     Queue:7 Depth=0; Oldest=0
>     Queue:8 Depth=0; Oldest=0
>     Queue:9 Depth=1; Oldest=1

Re: Pulling data from table

ShaneNewman — Fri, 08 Nov 2013 03:27:15 GMT

If all of the Queue data is in the same extracted field, i.e. Output_Response, then you will need to preform an mvexpand on that field to make it appear as though each queue is a different event. At that point, you can extract the queue number via the rex command

| rex field=Output_Response "Queue\:(?<queue>\d+)" | timechart sum(Depth) as Depth by queue

Re: Pulling data from table

AlexMcDuffMille — Fri, 08 Nov 2013 15:54:28 GMT

It doesn't appear to be in the same extracted field like that. I was able to get Splunk to just break up each line as a separate event and use the timestamp of the first line. That seems to work even though Splunk complains that each line doesn't have its own time stamp.