Getting Data In

draw a splunk chart depicting no of occurrences for different strings?

eleena1994
New Member

0
down vote
favorite
I want to draw a splunk chart and I have following strings in my logs:

"Request id: 552"
"Request id: 223"
"Request id: 365"
"Request id: 552"
"Request id: 552"
"Request id: 223"

I want to create a chart with x axis values as the request ids (552,223,365) and y axis values as number of occurrences of these request ids. What splunk search query would work?

Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

View solution in original post

0 Karma

eleena1994
New Member

Thank you. It worked the way I wanted 🙂

0 Karma

sundareshr
Legend

Try this

base search | stats count by "Request id"
0 Karma

Richfez
SplunkTrust
SplunkTrust

If this works, great, if you need help getting that result of numbers into an actual pretty graph, change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!