How to display my data in a graph over time?

[schu777]

I have the following line that is getting logged - it has totals for several queues in an app. I'd like to have a graph to show the totals as time goes - how can I accomplish this in Splunk? (Sorry, I'm very new to this part of Splunk) Note - these message are done every 5 minutes for development.

Thanks, Michael

Feb 27, 2015 11:14:39  totalOutAckCount=153 totalOutEnqCount=216 totalEnqueuedCount=0 totalErrorCount=123 totalErrorCount=2281

[cpetterborg · Accepted solution]

Try the following:

<yoursearch> | timechart span=5m last(totalOutAckCount) last(totalOutEnqCount) last(totalEnqueuedCount) last(totalErrorCount) last(totalErrorCount)

If your data is coming out with the key/value fields properly, this should work. If not, then a rex command will help, just reply about it here and we can come up with a rex that will work.

Be sure to look at the visualization tab for the actual graph.

[schu777]

I tried that above, but didn't work. Here is lines that I have. NOTE that each is a total of a queue for the application. I'd like to get a graph of each total. I'll play around with it and hopefully I can get something. I know having a count of what was processed would make thing easier in Splunk, but this is the first cut of splunk logging for this application.

    Mar 06, 2015 19:02:59  totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018
    Mar 06, 2015 18:57:59  totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018
    Mar 06, 2015 18:52:59  totalOutAckCrsCount=212 totalOutEnqCrsCount=301 totalEnqueuedPmsCount=0 totalErrorCrsCount=153 totalErrorPmsCount=1018

[schu777]

Well, I figured it out - I messed up on the names - the last post is the actual names - now it works! Now to put into a Dashboard for development, then once this goes out, production Dashboard!

THANKS!