Getting Data In

draw a splunk chart depicting no of occurrences for different strings?

eleena1994
New Member

0
down vote
favorite
I want to draw a splunk chart and I have following strings in my logs:

"Request id: 552"
"Request id: 223"
"Request id: 365"
"Request id: 552"
"Request id: 552"
"Request id: 223"

I want to create a chart with x axis values as the request ids (552,223,365) and y axis values as number of occurrences of these request ids. What splunk search query would work?

Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

First, add to your base search a rex to create a field out of Request IDs:

... your base search ... | rex "Request id:\s+(?<RequestID>\d+)"

Once you have that done and have run it, you should see on your left a new field RequestID.

For the rest, there's a couple of ways to attack it. Here's one.

... all the stuff above ... | chart count by RequestID

Then change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

Let us know how it goes!

0 Karma

eleena1994
New Member

Thank you. It worked the way I wanted 🙂

0 Karma

sundareshr
Legend

Try this

base search | stats count by "Request id"
0 Karma

Richfez
SplunkTrust
SplunkTrust

If this works, great, if you need help getting that result of numbers into an actual pretty graph, change to the visualizations tab, and near the upper left change it from "Line Chart" to "Column Chart" and that should do it.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...