Getting Data In

draw a splunk chart depicting no of occurrences for different strings?

eleena1994
New Member

0
down vote
favorite
I want to draw a splunk chart and I have following strings in my logs:

"Request id: 552"
"Request id: 223"
"Request id: 365"
"Request id: 552"
"Request id: 552"
"Request id: 223"

I want to create a chart with x axis values as the request ids (552,223,365) and y axis values as number of occurrences of these request ids. What splunk search query would work?

Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

0 Karma

eleena1994
New Member

Thank you. It worked the way I wanted 🙂

0 Karma

sundareshr
Legend

Try this

base search | stats count by "Request id"
0 Karma

Richfez
SplunkTrust
SplunkTrust

If this works, great, if you need help getting that result of numbers into an actual pretty graph, change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...