Splunk Search

Extract a specific value and make a visualization with time

john_snow00
Observer

I have regular traffic passing through my server. The server has the IP 10.41.6.222

My goal is to extract the Rate /sec passing through the server and  to be able to see theRate /sec in a graph an having x asis showing time and y axis Rate /sec (extracted values).

-----------------------------------------------------------------------------------------------------------------------------------

 

Rate 0/sec : Bytes 9815772 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 402/sec : Bytes 9816135 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 139587/sec : Bytes 10004146 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 147636/sec : Bytes 10009645 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 69967/sec : Bytes 10358668 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 69967/sec : Bytes 10361672 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 69967/sec : Bytes 10364579 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 69967/sec : Bytes 10364667 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 49661/sec : Bytes 10371887 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 217793/sec : Bytes 10700517 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 353829/sec : Bytes 10944230 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 93689/sec : Bytes 10946290 : from owa client to vs_owa with address 10.41.6.166:443:10.41.6.222Rate 82030/sec : Bytes 10950753 : from owa client to vs_owa with address

Labels (3)
0 Karma

john_snow00
Observer

Thank you Giuseppe. Can you please explain line after line ? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @john_snow00,

I try to explain:

<your_search> --- it's your search, e.g. index=your_index sourcetype=your_sourcetype ---
| rex "Rate\s+(?<Bytes>\d+)\/sec" --- Bytes field extraction ---
| eval MB=Bytes/1024/1024 --- change measure of Bytes field from bytes to MB ----
| timechart sum(MB) AS MB --- sum of the traffic foe time periods, it's possible to define this span period ---

Ciao.

Giuseppe

0 Karma

john_snow00
Observer

Thank you for the  explanation. The rate in seconds you see above  are produced by Loadbalancer upon incoming TCP requests.  The logs are later pushed to splunk for analysis.

I d'ont want to carry any futher calculation. I just want to extract the rate /sec from the raw and present it upon time (x-axis).

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @john_snow00,

sorry, where is the timestamp?

if it isn't contained in the event, it's added by Splunk.

Anyway, you could run something like this:

<your_search>
| rex "Rate\s+(?<Bytes>\d+)\/sec"
| eval MB=Bytes/1024/1024
| timechart sum(MB) AS MB

I also added the regex to extract the field, if you already have it, don't use my regex.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...