I have the following line that is getting logged - it has totals for several queues in an app. I'd like to have a graph to show the totals as time goes - how can I accomplish this in Splunk? (Sorry, I'm very new to this part of Splunk) Note - these message are done every 5 minutes for development.
Thanks, Michael
Feb 27, 2015 11:14:39 totalOutAckCount=153 totalOutEnqCount=216 totalEnqueuedCount=0 totalErrorCount=123 totalErrorCount=2281
Try the following:
<yoursearch> | timechart span=5m last(totalOutAckCount) last(totalOutEnqCount) last(totalEnqueuedCount) last(totalErrorCount) last(totalErrorCount)
If your data is coming out with the key/value fields properly, this should work. If not, then a rex
command will help, just reply about it here and we can come up with a rex
that will work.
Be sure to look at the visualization tab for the actual graph.
Try the following:
<yoursearch> | timechart span=5m last(totalOutAckCount) last(totalOutEnqCount) last(totalEnqueuedCount) last(totalErrorCount) last(totalErrorCount)
If your data is coming out with the key/value fields properly, this should work. If not, then a rex
command will help, just reply about it here and we can come up with a rex
that will work.
Be sure to look at the visualization tab for the actual graph.
I tried that above, but didn't work. Here is lines that I have. NOTE that each is a total of a queue for the application. I'd like to get a graph of each total. I'll play around with it and hopefully I can get something. I know having a count of what was processed would make thing easier in Splunk, but this is the first cut of splunk logging for this application.
Mar 06, 2015 19:02:59 totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018
Mar 06, 2015 18:57:59 totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018
Mar 06, 2015 18:52:59 totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018
Well, I figured it out - I messed up on the names - the last post is the actual names - now it works! Now to put into a Dashboard for development, then once this goes out, production Dashboard!
THANKS!