multi field grouping

hindla — Fri, 22 Jan 2016 16:06:48 GMT

Hi Team,

we have a query to get response times from our logs and then do a range to group the Response Time

index=* host=hostname sourcetype=perf*  "*string pattern*"  | rex "GET.*\s(?<resptime>\d+)"   | rangemap field=resptime Lessthan1Sec=0-1000 One_to_ThreeSec=1001-3000 higher_than_three=3001-10000 default="greater_Than_10k" | timechart count by range

Now, this works fine for one host but unfortunately we want this data for multiple hosts and I am not able to list the time ranges for multiple hosts. Can anyone please help me here.

Re: multi field grouping

somesoni2 — Fri, 22 Jan 2016 18:40:54 GMT

Give this a try

 index=* host=hostname sourcetype=perf*  "*string pattern*"  | rex "GET.*\s(?<resptime>\d+)"   | rangemap field=resptime Lessthan1Sec=0-1000 One_to_ThreeSec=1001-3000 higher_than_three=3001-10000 default="greater_Than_10k" | eval host=host.":".range | timechart count by host

topic multi field grouping in Splunk Search

multi field grouping

Re: multi field grouping