topic How to make a time chart with a list of time values I extracted with rex? in Splunk Search

How to make a time chart with a list of time values I extracted with rex?

sankarms — Thu, 08 Dec 2016 20:25:08 GMT

I have timestamps in my logs like this:

[23/Oct/2016:23:56:00 --0700]

I extracted them from my log files with this search:

source=* * | rex field=_raw "(?ism)\[(?<time>\d+\/\w+\/.+)\]"

Now I want to make a timechart that shows the time on the x-axis and the number of occurrences in that time on the y-axis. I tried doing:

| timechart span=1h count by time

But that didn't give me what I wanted. In plain English, I want it to read like "you got a 100 requests from 9am-10am, 50 requests from 10am-11am, etc etc".

Bonus: I would like to offer more granularity based on what the user wants. Like they should be able to see that they got a 100 requests from 9am-10am, but then see specifically at what times between that hour the 100 requests came in.

Re: How to make a time chart with a list of time values I extracted with rex?

Flynt — Thu, 08 Dec 2016 20:33:24 GMT

Try converting your extracted timefield to epoch using strptime (appropriate for your time value, below is just an example) and cast that to _time directly to do your timechart

|eval test=strptime(time,"%d/%b/%Y:%H:%M")|eval _time=test|timechart span=1h count

Re: How to make a time chart with a list of time values I extracted with rex?

sankarms — Thu, 08 Dec 2016 20:40:52 GMT

What does _time=test mean?

Re: How to make a time chart with a list of time values I extracted with rex?

Flynt — Thu, 08 Dec 2016 20:51:49 GMT

This means set _time to the value of test which is an epoch value we created from the strptime statement.

Test is just an arbitrary field name I gave it. _time is Splunk internal timefield that is used when doing timechart.