How do I extract a string from a message and create a chart on that field?

[manmayee]

My message text contains a value like this:

2015-09-30 16:52:19.907|LOCATION:GATEWAY|SERVICE:DepositsRestProxy|VERSION:3|CLIENT:ARGOTELLER|BUSINESSSERVICE:deposit-account-debits-ep|OPERATION:NA|RESPONSETIME:990|STATUS:201449:Transaction processing requires manual intervention to be completed.|SEVERITY:ERROR|STATUSCODE:ERROR|STATUSMESSAGE:Conflict|DESCRIPTION:ClientIPAddress--10.42.132.193|MESSAGEID:10.42.8.151--3f8b2410:1501ffcf122:74b

I want to narrow my results to a table where it will show me a chart where it will show the graph of response times.

[vincenteous]

Hi manmayee,

I'm trying to complement swbodie's answer. Your search input should be like this:

<your base search> | rex field=_raw "\*RESPONSETIME:(?<ResponseTime>\d+)\*" | stats count by ResponseTime

The search command will show you a table by default. You may then choose visualization tab to get your chart.

Hope it helps.

[manmayee]

i tried this but still i am not seeing any result under statistics tab. only events tab i am seeing the results.

[somesoni2]

Do you see any results in the statistics tab when your run following query??

<your base search> | rex field=_raw "\*RESPONSETIME:(?<ResponseTime>\d+)\*" | table ResponseTime

[manmayee]

table is showing up but no values or nothing in that table

[vincenteous]

hmm...that's weird. I'd created a sample log file with your data and applied the rex command along with the stats command and I could see the graph just fine.

[swbodie]

You would want to use a regex to extract the field in this case, something like this would extract it to be used in subsequent searches in the pipeline:

| rex field=_raw ".*RESPONSETIME:(?<ResponseTime>.*)\*|.*"

Would add the response time to a field called ResponseTime for you to work with.

[manmayee]

Hi Swbodie, Thanks for your help.

i used the below but still i m nt seeing any result.

 | rex field=_raw ".*RESPONSETIME:(?.*)\*|.*" | eval temp=split(RespnseTime,":") |eval time=mvindex(ResponseTime,-1) | stats count by time as responsetime

I want to make graph where i will show me the response times so that i can check how many response time went above and below 500 ms.

I am new to splunk, any help is appreciated. Thank you...

[swbodie]

What that command is doing is a field extraction using a regular expression. I did not test the one I wrote above against your data so it may be off.

Have a look at this page which may help:

http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/rex

[manmayee]

Thanks Swbodie. But still i m just getting the search result as i was getting with my search string like below.

2015-09-30 16:52:19.907|LOCATION:GATEWAY|SERVICE:DepositsRestProxy|VERSION:3|CLIENT:ARGOTELLER|BUSINESSSERVICE:deposit-account-debits-ep|OPERATION:NA|*RESPONSETIME:990*|STATUS:201449:Transaction processing requires manual intervention to be completed.|SEVERITY:ERROR|STATUSCODE:ERROR|STATUSMESSAGE:Conflict|DESCRIPTION:ClientIPAddress--10.42.132.193|MESSAGEID:10.42.8.151--3f8b2410:1501ffcf122:74b

I want something like below. SO that i can prepare chart how many went above 200 and how many went below 300ms
RESPONSETIME : 200
RESPONSETIME: 300

I am quite new to splunk. Thank you so much for your help.