Getting Data In

draw a splunk chart depicting no of occurrences for different strings?

eleena1994
New Member

0
down vote
favorite
I want to draw a splunk chart and I have following strings in my logs:

"Request id: 552"
"Request id: 223"
"Request id: 365"
"Request id: 552"
"Request id: 552"
"Request id: 223"

I want to create a chart with x axis values as the request ids (552,223,365) and y axis values as number of occurrences of these request ids. What splunk search query would work?

Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

0 Karma

eleena1994
New Member

Thank you. It worked the way I wanted 🙂

0 Karma

sundareshr
Legend

Try this

base search | stats count by "Request id"
0 Karma

Richfez
SplunkTrust
SplunkTrust

If this works, great, if you need help getting that result of numbers into an actual pretty graph, change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...