- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to write a search to graph the duration script...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right now I have two different scripts: report scripts and procedure scripts. They have a begin and finished time. I am trying to create a graph using the time as the y-axis and the report as the x-axis and the procedure as x-axis on another graph. Example text would be...
2012-03-22 00:7:02,318 INFORMATION Begin Procedure Script
2012-03-22 00:8:02,318 INFORMATION FINISHED Procedure Script (0)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your question is too vague but this should get you started:
... | rex "^\W+\w+\W+\w+(?<Report>\W+)\w+(?<BeginOrFinished>\W+)\w+(?<Procedure>.*)$" | where BeginOrFinished="Begin" | timechart ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your question is too vague but this should get you started:
... | rex "^\W+\w+\W+\w+(?<Report>\W+)\w+(?<BeginOrFinished>\W+)\w+(?<Procedure>.*)$" | where BeginOrFinished="Begin" | timechart ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there anything I clarify? But thank you for answering.. I will check what those commands do.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What exactly are you trying to chart? I can guess but that is silly! Just for grins, here are a few guesses with answers:
To chart the number of jobs completed per Report per hour, do this:
... | rex "^\W+\w+\W+\w+(?<Report>\W+)\w+(?<BeginOrFinished>\W+)\w+(?<Procedure>.*)$" | timechart span=1h count(eval(BeginOrFinished="FINISHED")) AS CompletedJobCount by Report
To chart the number of jobs initiated per Procedure per minute, do this:
... | rex "^\W+\w+\W+\w+(?<Report>\W+)\w+(?<BeginOrFinished>\W+)\w+(?<Procedure>.*)$" | timechart span=1m count(eval(BeginOrFinished="Begin")) AS InitiatededJobCount by Procedure
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I fixed a minor error (re-edited).
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
