Splunk Search

chart for startup time

benji00
New Member

Hello,

I would like to monitor my TomEE restart occurences and time execution, so I am looking for the expression: "Server startup in" and I am receiving the following events:

27-Feb-2019 14:12:05.781 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 4281 ms
25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms
25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms
23-Feb-2019 02:00:56.253 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 289897 ms

How can I chart those times in ms ?

Regards

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Something like this should get you started.

index=foo "Server startup in" | rex "startup in (?<ms>\d+)" | timechart values(ms)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Something like this should get you started.

index=foo "Server startup in" | rex "startup in (?<ms>\d+)" | timechart values(ms)
---
If this reply helps you, Karma would be appreciated.
0 Karma

benji00
New Member

That's exasperating how easy is the request compared to the time to turn around it 🙂
Anyway @richgalloway thanks very much.
Last precision:
- I set the span to 1h as by default if Time Range is "Last 7 Days" it is set to 1 day
- So sometimes I have many occurences in the same span (in this case I would like to do an average of all the values) and sometimes I have no values (in this case I would like to hide the results in the timechart if possible).

Any idea?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any way to do that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

benji00
New Member

OK @richgalloway, I will try to find on my own. Thanks again

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...