topic Re: How do I extract a string from a message and create a chart on that field? in Splunk Search

How do I extract a string from a message and create a chart on that field?

manmayee — Wed, 30 Sep 2015 21:08:46 GMT

My message text contains a value like this:

I want to narrow my results to a table where it will show me a chart where it will show the graph of response times.

Re: How do I extract a string from a message and create a chart on that field?

swbodie — Wed, 30 Sep 2015 21:24:21 GMT

You would want to use a regex to extract the field in this case, something like this would extract it to be used in subsequent searches in the pipeline:

| rex field=_raw ".*RESPONSETIME:(?<ResponseTime>.*)\*|.*"

Would add the response time to a field called ResponseTime for you to work with.

Re: How do I extract a string from a message and create a chart on that field?

manmayee — Thu, 01 Oct 2015 13:01:10 GMT

Thanks Swbodie. But still i m just getting the search result as i was getting with my search string like below.

2015-09-30 16:52:19.907|LOCATION:GATEWAY|SERVICE:DepositsRestProxy|VERSION:3|CLIENT:ARGOTELLER|BUSINESSSERVICE:deposit-account-debits-ep|OPERATION:NA|*RESPONSETIME:990*|STATUS:201449:Transaction processing requires manual intervention to be completed.|SEVERITY:ERROR|STATUSCODE:ERROR|STATUSMESSAGE:Conflict|DESCRIPTION:ClientIPAddress--10.42.132.193|MESSAGEID:10.42.8.151--3f8b2410:1501ffcf122:74b

I want something like below. SO that i can prepare chart how many went above 200 and how many went below 300ms
RESPONSETIME : 200
RESPONSETIME: 300

I am quite new to splunk. Thank you so much for your help.

Re: How do I extract a string from a message and create a chart on that field?

manmayee — Thu, 01 Oct 2015 14:14:46 GMT

Hi Swbodie, Thanks for your help.

i used the below but still i m nt seeing any result.

 | rex field=_raw ".*RESPONSETIME:(?.*)\*|.*" | eval temp=split(RespnseTime,":") |eval time=mvindex(ResponseTime,-1) | stats count by time as responsetime

I want to make graph where i will show me the response times so that i can check how many response time went above and below 500 ms.

I am new to splunk, any help is appreciated. Thank you...

Re: How do I extract a string from a message and create a chart on that field?

swbodie — Thu, 01 Oct 2015 17:17:10 GMT

What that command is doing is a field extraction using a regular expression. I did not test the one I wrote above against your data so it may be off.

Have a look at this page which may help:

http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/rex

Re: How do I extract a string from a message and create a chart on that field?

vincenteous — Mon, 05 Oct 2015 07:33:38 GMT

Hi manmayee,

I'm trying to complement swbodie's answer. Your search input should be like this:

<your base search> | rex field=_raw "\*RESPONSETIME:(?<ResponseTime>\d+)\*" | stats count by ResponseTime

The search command will show you a table by default. You may then choose visualization tab to get your chart.

Hope it helps.

Re: How do I extract a string from a message and create a chart on that field?

manmayee — Mon, 05 Oct 2015 15:45:16 GMT

i tried this but still i am not seeing any result under statistics tab. only events tab i am seeing the results.

Re: How do I extract a string from a message and create a chart on that field?

somesoni2 — Mon, 05 Oct 2015 16:22:46 GMT

Do you see any results in the statistics tab when your run following query??

<your base search> | rex field=_raw "\*RESPONSETIME:(?<ResponseTime>\d+)\*" | table ResponseTime

Re: How do I extract a string from a message and create a chart on that field?

manmayee — Mon, 05 Oct 2015 21:59:51 GMT

table is showing up but no values or nothing in that table

Re: How do I extract a string from a message and create a chart on that field?

vincenteous — Tue, 06 Oct 2015 03:22:41 GMT

hmm...that's weird. I'd created a sample log file with your data and applied the rex command along with the stats command and I could see the graph just fine.