Dashboards & Visualizations

Visualization not working after extracting values from raw data

srizan
Path Finder

Raw Value:

 

logtype=audit 2020-06-15T12:25:52,650| tid:SDFGH3456gtbhjcfdt$%| AUTHN_REQUEST| | 38 | | 123| | asdxc| AS| ss| | | 40 

 

Query:

 

index = "PF.log" 
| eval fields=split(_raw,"|")
| eval response=mvindex(fields,13)
| timechart values(response) BY host

 

I am interested in the last value which is 40 in this example. I tried converting the value tonumber and tried other conversion techniques which doesn't seem to work for some reason. 

Labels (1)
0 Karma
1 Solution

niketn
Legend

@srizan you would need to add trim if you are plotting it on chart as regular split with your data will have space around response value. 

| eval response=trim(mvindex(fields,13))

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@srizan you would need to add trim if you are plotting it on chart as regular split with your data will have space around response value. 

| eval response=trim(mvindex(fields,13))

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

srizan
Path Finder

@niketn Thank you! That worked!! I was using rex to extract the value but this seems to be cleaner approach. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you switch to the Statistics tab do you see data?  Are the _time, response, and host fields present?

---
If this reply helps you, Karma would be appreciated.

srizan
Path Finder

I was able to work around using rex to extract the value. Still unsure why conversion did not work.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...