Splunk Search

chart for startup time

benji00
New Member

Hello,

I would like to monitor my TomEE restart occurences and time execution, so I am looking for the expression: "Server startup in" and I am receiving the following events:

27-Feb-2019 14:12:05.781 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 4281 ms
25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms
25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms
23-Feb-2019 02:00:56.253 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 289897 ms

How can I chart those times in ms ?

Regards

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Something like this should get you started.

index=foo "Server startup in" | rex "startup in (?<ms>\d+)" | timechart values(ms)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Something like this should get you started.

index=foo "Server startup in" | rex "startup in (?<ms>\d+)" | timechart values(ms)
---
If this reply helps you, Karma would be appreciated.
0 Karma

benji00
New Member

That's exasperating how easy is the request compared to the time to turn around it 🙂
Anyway @richgalloway thanks very much.
Last precision:
- I set the span to 1h as by default if Time Range is "Last 7 Days" it is set to 1 day
- So sometimes I have many occurences in the same span (in this case I would like to do an average of all the values) and sometimes I have no values (in this case I would like to hide the results in the timechart if possible).

Any idea?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any way to do that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

benji00
New Member

OK @richgalloway, I will try to find on my own. Thanks again

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...