Splunk Search

How to generate a chart based on Duration (x-axis) and timestamp (y-axis)?

chanamoluk
Explorer

How to generate a chart based on Duration (x-axis) and timestamp (y-axis)?

12/19/2016 10:30:53 AM
LogName=JHApplication
... 7 lines omitted ...
RecordNumber=23080258
Keywords=Classic
Message=Action=ConsumeMessage, ConsumerType=InprocConsumer, ConsumerTypeName=WorkflowEndpoint, ConsumerMethodName=CustomerUpdateResponse, ConsumerParam=XmlNode, MessageId=1b411832-3625-4c19-aaf6-22a258a4dabd\1844534213, Duration=0.0284597

0 Karma
1 Solution

somesoni2
Revered Legend

Strange. It's in standard key value pair format and should've been extract. Try something like this

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |stats values(Duration) as Duration by _time

OR

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |timechart avg(Duration) as Duration

View solution in original post

0 Karma

somesoni2
Revered Legend

Strange. It's in standard key value pair format and should've been extract. Try something like this

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |stats values(Duration) as Duration by _time

OR

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |timechart avg(Duration) as Duration
0 Karma

chanamoluk
Explorer

thank you so much.... its working

0 Karma

somesoni2
Revered Legend

Try this

your base search | stats values(Duration) as Duration by _time
0 Karma

chanamoluk
Explorer

index=* host=*MQ004 Duration|stats values(Duration) as Duration by _time

it is showing only the _time but it is not displaying the Duration value, every minute it is generating 10 to 20 messages

0 Karma

somesoni2
Revered Legend

Is Duration field already extracted (can you see the field Duration in the field sidebar)? If not then try something like this

0 Karma

chanamoluk
Explorer

no i can't see Duration field on the left side

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...