Splunk Search

How to create a time series from a log file?

amdosh
Explorer

I have a log file with a unique identifier (requestid) for a sequence of events. I want to show a breakup of all events within the requestid. I plan to show that by "marking" the start and stop logs of different events (based on the specific log message) I plan to track and finally create some table like this:

06/14/22 12:35:03.022 requestid=1requestid1 started
06/14/22 12:36:03.022 requestid=1 Event1 started
06/14/22 1237:03.022 requestid=1Event2 started
06/14/22 12:38:03.022 requestid=1 Event2 ended
06/14/22 12:39:03.022 requestid=1 Event1 ended
06/14/22 12:40:03.022 requestid=1requestid1 ended

Event      | Start Time                              | Duration
------------------------------------
Event1| 06/14/22 12:36:03.022.     |  180
Event2| 06/14/22 12:37:03.022.     |  60

The timeseries will be across the duration of the requestid transaction of 5 mins. Could you let me know how this can be achieved? Thanks!

Labels (1)
0 Karma
1 Solution

amdosh
Explorer

I think the best solution for me would be to modify the logs to have something like below and use transaction on the new tracker field.

06/14/22 12:35:03.022 requestid=1 requestid1 started
06/14/22 12:36:03.022 requestid=1 tracker=Event1 started
06/14/22 1237:03.022 requestid=1 tracker=Event2 started
06/14/22 12:38:03.022 requestid=1 tracker=Event2 ended
06/14/22 12:39:03.022 requestid=1 tracker=Event1 ended
06/14/22 12:40:03.022 requestid=1 tracker=requestid1 ended

View solution in original post

0 Karma

amdosh
Explorer

I think the best solution for me would be to modify the logs to have something like below and use transaction on the new tracker field.

06/14/22 12:35:03.022 requestid=1 requestid1 started
06/14/22 12:36:03.022 requestid=1 tracker=Event1 started
06/14/22 1237:03.022 requestid=1 tracker=Event2 started
06/14/22 12:38:03.022 requestid=1 tracker=Event2 ended
06/14/22 12:39:03.022 requestid=1 tracker=Event1 ended
06/14/22 12:40:03.022 requestid=1 tracker=requestid1 ended

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...