| regex "message.message"="Total count XXXXXX: |Total rows YYYYYY: " | rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:(?<msg4>[^:]*)($|\{)" | eval dtonly=strftime(_time, "%Y%m%d") | chart first(msg4) OVER dtonly BY msg3
I get the stats but not the visualization.
Thanks
It looks like you might have a space between the : and the numbers. The values are left aligned, indicating a string rather than a numeric. Try accounting for the space (if it is there) and only extract digits for msg4.
| rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:\s*(?<msg4>\d*)"
Is that what you are looking for? Sorry! I am new to Splunk.
It's a glue job log output, something like this. one run per day.
INFO:__main__:Total rows: 893
...
INFO:__main__:Total count in segments schema: 18504
@Jeet, you might want to check the maximum number of values that are supported by the visualization that you have selected to output. I have had this happen to me - I can see the (>50,000) values, but the visualization only supports 50,000 rows. That >18,000 might be too high.
Data to be plotted won't be more than 50 rows. Enclosing stat output for 2 rows which is not getting plotted.
It looks like you might have a space between the : and the numbers. The values are left aligned, indicating a string rather than a numeric. Try accounting for the space (if it is there) and only extract digits for msg4.
| rex field="message.message" max_match=0 "^(?<msg1>[^:]*)\:(?<msg2>[^:]*)\:(?<msg3>[^:]*)\:\s*(?<msg4>\d*)"
That did the trick. Thank you!!
So.... What do you see when you switch to the visualization and which visualization are you trying to use?
Can you share some events in a code block </> so we can better see what you are dealing with?