draw a splunk chart depicting no of occurrences for different strings?

[eleena1994]

0
down vote
favorite
I want to draw a splunk chart and I have following strings in my logs:

"Request id: 552"
"Request id: 223"
"Request id: 365"
"Request id: 552"
"Request id: 552"
"Request id: 223"

I want to create a chart with x axis values as the request ids (552,223,365) and y axis values as number of occurrences of these request ids. What splunk search query would work?

[Richfez · Accepted solution]

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

[eleena1994]

Thank you. It worked the way I wanted 🙂

[sundareshr]

Try this

base search | stats count by "Request id"

[Richfez]

If this works, great, if you need help getting that result of numbers into an actual pretty graph, change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.