Splunk Search

How to generate a chart based on Duration (x-axis) and timestamp (y-axis)?

chanamoluk
Explorer

How to generate a chart based on Duration (x-axis) and timestamp (y-axis)?

12/19/2016 10:30:53 AM
LogName=JHApplication
... 7 lines omitted ...
RecordNumber=23080258
Keywords=Classic
Message=Action=ConsumeMessage, ConsumerType=InprocConsumer, ConsumerTypeName=WorkflowEndpoint, ConsumerMethodName=CustomerUpdateResponse, ConsumerParam=XmlNode, MessageId=1b411832-3625-4c19-aaf6-22a258a4dabd\1844534213, Duration=0.0284597

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Strange. It's in standard key value pair format and should've been extract. Try something like this

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |stats values(Duration) as Duration by _time

OR

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |timechart avg(Duration) as Duration

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Strange. It's in standard key value pair format and should've been extract. Try something like this

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |stats values(Duration) as Duration by _time

OR

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |timechart avg(Duration) as Duration
0 Karma

chanamoluk
Explorer

thank you so much.... its working

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search | stats values(Duration) as Duration by _time
0 Karma

chanamoluk
Explorer

index=* host=*MQ004 Duration|stats values(Duration) as Duration by _time

it is showing only the _time but it is not displaying the Duration value, every minute it is generating 10 to 20 messages

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Is Duration field already extracted (can you see the field Duration in the field sidebar)? If not then try something like this

0 Karma

chanamoluk
Explorer

no i can't see Duration field on the left side

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...