Splunk Search

Display time graph based on peak events over time || based on the log occurence i need to plot the graph over time

d942725
New Member

I have a use case where i need to plot the time graph, which shows the events count based on time. I must be able to see the graphical view of spike in the events I receive over time. I have some log similar to the one mentioned below:
{
@timestamp: 2020-02-04T13:46:41.274+00:00
domain: test
environment: dev
level: INFO
logger_name: com.test.practice.evthub.sse.impl.EventEncrypter
message: Published records to Kinesis stream
thread_name: main
}

Query: domain="test" environment="dev" logger_name="com.test.practice.evthub.sse.impl.EventEncrypter" message="Published records to Kinesis stream"|stats count by message
I tried using timechart function by passing the message as input but was getting some tabular format instead of graph plots. Can someone help me to do this query ?

0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
domain="test" environment="dev" AND logger_name="com.test.practice.evthub.sse.impl.EventEncrypter" AND message="Published records to Kinesis stream"
|timechart count by message

Is this wrong?

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust
domain="test" environment="dev" AND logger_name="com.test.practice.evthub.sse.impl.EventEncrypter" AND message="Published records to Kinesis stream"
|timechart count by message

Is this wrong?

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust

please acceptand close your issue.

0 Karma

Richfez
SplunkTrust
SplunkTrust

I moved your comment to an answer, and it seems pretty apparent the user accepts this, so I will accept for him.

0 Karma

d942725
New Member

Yeah able to do and it works as expected.

0 Karma