Fetching splunk keywords from Splunk logs and create queries

[aditsss]

Hi team,

I am currently getting splunk logs as shown below:

2023-07-11 02:31:43.207 [INFO ] [pool-2-thread-1] FileSensor - Total msg processed for trim reage file:254

host = lgposput503.gso.com
source = abs-upstreamer.log
sourcetype = 600000304_gg_abs_ipc2

I want to fetch this keyword from splunk logs "Total msg processed for trim reage file:{}"

Also Can someone guide me how can I create query to present it in bar form as of now I have created query  like this:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/amex/app/abs-upstreamer/logs/abs-upstreamer.log" "Total msg processed for trim reage file"

But I AM NOT ABLE TO CREATE IT IN ANY CHART/BAR FORM.

Can someone help me out with the queries.

Thanks in advance

[gcusello]

Hi @aditsss,

with your search you can filter logs, which are the fields to use for grouping and charting events?

if you want the count for each host, you could run something like this:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/amex/app/abs-upstreamer/logs/abs-upstreamer.log" "Total msg processed for trim reage file"
| stats count BY host

or if you want a time distribution of these events, you could run something like this:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/amex/app/abs-upstreamer/logs/abs-upstreamer.log" "Total msg processed for trim reage file"
| timechart count

Ciao.

Giuseppe

[aditsss]

@gcusello 

I want this to be displayed on chart

"Total msg processed for trim reage file" I want this to be in my chart along with count as every time the value is different.

I want to show this with value:

2023-07-11 02:31:43.207 [INFO ] [pool-2-thread-1] FileSensor - Total msg processed for trim reage file:254

2023-07-10 02:31:43.207 [INFO ] [pool-2-thread-1] FileSensor - Total msg processed for trim reage file:300

you can see value is different I want to show that value on bar chart along with "Total msg processed for trim reage file" message  as the value will be different for each day.

[gcusello · Accepted solution]

Hi @aditsss,

let me understand: you want to extract the value after the "Total msg processed for trim reage file:" string and display it, is it correct?

If you have only one value a day, you could run something like this:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/amex/app/abs-upstreamer/logs/abs-upstreamer.log" "Total msg processed for trim reage file:"
| rex "Total msg processed for trim reage file:(?<count>\d+)"
| table _time count

If you have more values a day and you want only one value a day, you can use timechart and calculate average:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/amex/app/abs-upstreamer/logs/abs-upstreamer.log" "Total msg processed for trim reage file:"
| rex "Total msg processed for trim reage file:(?<count>\d+)"
| timechart span=1d values(count) AS count

Ciao.

Giuseppe