I was wondering how can i extract the values from a particular xml tag in my log file to plot a chart. Every 10 seconds, i am going to push something like <count>15</count>
into the log file. The value inside the <count>
tag differs every time, i write to the log file. I want Splunk to index such data. How can i extract those changing values from log file and plot a graph using splunk search language.
Use xmlkv
to get the values: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xmlkv
Then use table
or timechart
to plot your values. If you choose to go for the timechart
option, keep in mind that it operates on timespans so you need to feed it with some statistical function to tell it how to handle any events where multiple values show up in a timespan. For instance you could use avg
to just get the average in the unlikely event that two values show up in the same span. More info on timechart
: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart