How can I make a timechart from the following data?

[zachary_hickman]

I have data that appears in this format:

2013-05-16 09:40:25,861 "*alphanumeric*"=*number*, "*alphanumeric*"=*number*, ...

Note that there are no duplicate alphanumeric values in each event.

I would like to graph based on the sum of all *number*s for all the *alphanumeric* events for each day. So if in 5 different events on 5/16, "FIELD1" appeared, with the values 1, 2, 3, 4, and 5, the graph would show the value 15 for "FIELD1". I'll also be making this a stacked bar graph, but that shouldn't make a difference.

My biggest issue is separating the data within each event and then summing the data. If someone could point me in the right direction, it would be very appreciated!

[martin_mueller · Accepted solution]

Assuming your alphanumeric field names are auto-extracted due to being key=value pairs, you should be able to do this:

your search | timechart span=1d sum(*)

[martin_mueller]

Then the next step would be to get those fields extracted, see http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextrac... for reference.

[zachary_hickman]

The alphanumeric isn't a key unfortunately, it's just like two variable pairs.