Chart field value over time

[alebaffajp]

Hi,
I am very new to Splunk and I would like to make a graph that shows the average value of response_time over the time (it can be 1 day to N-days). The log I have is like the one here below and it comes from some web API.

1 2017-08-02T01:10:06.949467+00:00 loggregator 43534534 - - myawesomewebsite.net - [02/08/2017:01:10:06.914 +0000] "GET /v1.0/myawesomeAPI HTTP/1.1" 403 0 112 "-" "curl/7.35.0" "127.0.0.1:345345" response_time:0.034484842 app_id:"44444" 

In my query search I just need to consider all the events, so I guess it would be something like ** response_time*. I tried different things, but I always get nothing.

Thank you very much in advance for any help! Love Splunk!

[gcusello · Accepted solution]

Hi alebaffajp,

index=_your_index sourcetype=your_sourcetype
| rex "response_time:(?<response_time>[^ ]*)"
| timechart span=1d avg(response_time)

If you extract response_time field, you don't need of the rex command in the search.

Bye.
Giuseppe

[alebaffajp]

Thank you very much! It works! Grazie 😉