Splunk Search

How do I parse single-line entries for stacked timechart?

mikeely
Path Finder

I've got a scripted input that dumps a line like the following every minute:

2011-12-22 08:46:56,0,30,6

What I'd like to do is parse it for a stacked timechart as follows:
Datestamp, Critical, Error, Warning

I know the comma is my delimiter, but beyond that I'm kind of at a loss. Any help?

Tags (2)
0 Karma
1 Solution

mikeely
Path Finder

Self-answering:

sourcetype="my_custom_sourcetype" | timechart sum("Critical"),sum("Error"),sum("Warning") by time

View solution in original post

0 Karma

mikeely
Path Finder

Self-answering:

sourcetype="my_custom_sourcetype" | timechart sum("Critical"),sum("Error"),sum("Warning") by time

0 Karma

mikeely
Path Finder

Update: I managed to use the IFX to correctly parse the fields so Critical/Error/Warning are being counted. Now I need to figure out how to do the stacked area chart based on COUNT(Critical),COUNT(Error),COUNT(Warning) for each time the script generates a row.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...