Splunk Search

Extract Field values and plot on time series graph

nkavouris
Path Finder

I would like to extract the Message, Timestamp, and serial fields

Then I would like to plot the target: Temp(315600), state: Temp(315600), cavity: 178900 

Each on individual plots based on the time series

I take it I will have to use a rex command to extract the bolded values from the message field.
How would I go about this?

{"bootcount":10,"device_id":"71ff6686fa5347828e3668e59249d0be","environment":"prod_walker",
"
event_source":"appliance","event_type":"GENERIC","location":
{"city":"","country":"XXX","latitude":XXX,"longitude":XXX,"state":""},
"
log_level":"info","message":"hardware_controller: TestState { target: Temp(315600), state: Temp(315600), cavity: 178900, fuel: None, shutdown: None, errors: test() }",
"
model_number":"XXXX","sequence":1411,"serial":"XXXX","software_version":"2.2.2.7641","ticks":158236,"timestamp":1717972790}

 

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "target: Temp\((?<target>\d+)\), state: Temp\((?<state>\d+)\), cavity: (?<cavity>\d+)"

 

0 Karma

nkavouris
Path Finder

I have accomplished the Rex using field extractor

but as for plotting the values this is not of much help, id like to plot the values found with the associated timestamp of the event into a line chart

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The extraction gives you the values for the fields for each event. Each event will have an _time field with the time of the event. You have all the information you need to plot the values against time. Is it simply that you want to restrict the fields that are plotted?

| table _time target state cavity

The first field will be the x-axis on the chart (when you select a line chart as your visualisation), the other fields will be the series in the chart, each of which will be a line on the chart. What more do you need?

0 Karma

marnall
Motivator

Does it appear when you change the search results to the "visualization" tab,  then switch the visualization to "Line Chart"?

 

Alternatively could you try:

<your search that extracts the fields>
| timechart mode(target) as target mode(state) as state mode(cavity) as cavity
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...