Splunk Search
Highlighted

How to combine access log data from multiple sources over time in the same line graph?

New Member

Greetings!

I have access logs from multiple sources that I'd like to combine into the same graph, basically to count the number of hits per minute on each source.

index=ihs source="*_access_log.*" |  timechart span=1m count(eval(source="/logdir/http-logs/source1_access_log.%Y%m%d")) AS source1, count(eval(source="/logdir/http-logs/source2_access_log.%Y%m%d")) AS source2, count(eval(source="/logdir/http-logs/source3_access_log.%Y%m%d")) AS source3, count(eval(source="/logdir/http-logs/source4_access_log.%Y%m%d")) AS source4

Basically each source has its own name and today's date. I'm not really sure how to approach it, but the above and everything else I've been trying doesn't work.

Thanks,
Aaron

0 Karma
Highlighted

Re: How to combine access log data from multiple sources over time in the same line graph?

New Member
 index=ihs source="*_access_log.*" |  timechart span=1m count(eval("source=/logdir/http-logs/source1_access_log.'%Y%m%d'")) AS source1, count(eval("source=/logdir/http-logs/source2_access_log.'%Y%m%d'")) AS source2, count(eval("source=/logdir/http-logs/source3_access_log.'%Y%m%d'")) AS source3, count(eval("source=/logdir/http-logs/source4_access_log.'%Y%m%d'")) AS source4

I tried that. It actually gets counts ind the source# table, but all of the counts are the same! Ugh. The search works fine when I manually specify the date of 20151119 at the end of the access log

0 Karma
Highlighted

Re: How to combine access log data from multiple sources over time in the same line graph?

Legend

Have you tried (for the given sample data)

index=ihs source="*_access_log.*" | rex field=source "(?<src>\w+\d)" |  timechart span=1m count by source
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.