I have the below log text
You don't need to extract timestamps since Splunk does that for you. The _time field is not available for a timechart because the stats command discarded it. Try this query, instead.
index="tim" logGroup="/ecs/sit-ol-service-validator" "logEvents{}.message"="*Validating the User with userID*"
| spath output=myfield path=logEvents{}.message
| rex field=myfield "Validating the User with userID:(?<userId>[0-9]+) systemID:"
| fields userId
| timechart span=1d count by userId
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
You don't need to extract timestamps since Splunk does that for you. The _time field is not available for a timechart because the stats command discarded it. Try this query, instead.
index="tim" logGroup="/ecs/sit-ol-service-validator" "logEvents{}.message"="*Validating the User with userID*"
| spath output=myfield path=logEvents{}.message
| rex field=myfield "Validating the User with userID:(?<userId>[0-9]+) systemID:"
| fields userId
| timechart span=1d count by userId
It returns null as a table column I exclude it by usenull=f
It is giving userId wise count like for Today :
userId1 in below row count 2 userId2 in below count 3.
_time | userId1 | userId2 | Null
2020-10-14 | 11 | 0 | 11
2020-10-13 | 10 | 0 | 10
But I want per day total userId. let say for today total userId: 5 (not individually).
_time | total |
2020-10-14| 11 |
2020-10-13| 12 |
Hope its clear now
Thanks
Solved
index="tim" logGroup="/ecs/sit-ol-service-validator" "logEvents{}.message"="*Validating the User with userID*"
| spath output=myfield path=logEvents{}.message
| rex field=myfield "Validating the User with userID:(?<userId>[0-9]+) systemID:"
| fields dc(userId)
| timechart span=1h dc(userId)