Splunk Search

chart for startup time

benji00
New Member

Hello,

I would like to monitor my TomEE restart occurences and time execution, so I am looking for the expression: "Server startup in" and I am receiving the following events:

27-Feb-2019 14:12:05.781 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 4281 ms
25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms
25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms
23-Feb-2019 02:00:56.253 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 289897 ms

How can I chart those times in ms ?

Regards

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Something like this should get you started.

index=foo "Server startup in" | rex "startup in (?<ms>\d+)" | timechart values(ms)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Something like this should get you started.

index=foo "Server startup in" | rex "startup in (?<ms>\d+)" | timechart values(ms)
---
If this reply helps you, Karma would be appreciated.
0 Karma

benji00
New Member

That's exasperating how easy is the request compared to the time to turn around it 🙂
Anyway @richgalloway thanks very much.
Last precision:
- I set the span to 1h as by default if Time Range is "Last 7 Days" it is set to 1 day
- So sometimes I have many occurences in the same span (in this case I would like to do an average of all the values) and sometimes I have no values (in this case I would like to hide the results in the timechart if possible).

Any idea?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any way to do that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

benji00
New Member

OK @richgalloway, I will try to find on my own. Thanks again

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...