Splunk Search

chart for startup time

benji00
New Member

Hello,

I would like to monitor my TomEE restart occurences and time execution, so I am looking for the expression: "Server startup in" and I am receiving the following events:

27-Feb-2019 14:12:05.781 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 4281 ms
25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms
25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms
23-Feb-2019 02:00:56.253 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 289897 ms

How can I chart those times in ms ?

Regards

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Something like this should get you started.

index=foo "Server startup in" | rex "startup in (?<ms>\d+)" | timechart values(ms)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Something like this should get you started.

index=foo "Server startup in" | rex "startup in (?<ms>\d+)" | timechart values(ms)
---
If this reply helps you, Karma would be appreciated.
0 Karma

benji00
New Member

That's exasperating how easy is the request compared to the time to turn around it 🙂
Anyway @richgalloway thanks very much.
Last precision:
- I set the span to 1h as by default if Time Range is "Last 7 Days" it is set to 1 day
- So sometimes I have many occurences in the same span (in this case I would like to do an average of all the values) and sometimes I have no values (in this case I would like to hide the results in the timechart if possible).

Any idea?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of any way to do that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

benji00
New Member

OK @richgalloway, I will try to find on my own. Thanks again

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...