Reporting

Reporting by parsing entries in fields

er1kr1984
New Member

Hi All

i am new to Splunk and hope this is not to much of a stupid question.

i am looking to create a report in the form of a line graph that shows the following values CPU values by time on the Y axis and cpu usage on the X axis

2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=65.17%
2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=62.09%
2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=60.17%
2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=59.12%
2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=59.09%

i have tried several different things but stuck at the moment any help would be fantastic

Tags (1)
0 Karma

gfuente
Motivator

Hello,

First of all, you´ll need to extract the values you want to chart in a new field with the rex command:

...| rex "CPU:\s0=(?< cpu_values >\d+\.\d+)" | ...

*without the spaces before and after the cpu_values

Then you need to use time chart, you´ll search would look something similar to:

sourcetype="mysourcetype" | rex "CPU:\s0=(?< cpu_values >\d+\.\d+)" | timechart avg(cpu_values)

Regards

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...