Splunk Search

multi field grouping

hindla
New Member

Hi Team,

we have a query to get response times from our logs and then do a range to group the Response Time

index=* host=hostname sourcetype=perf*  "*string pattern*"  | rex "GET.*\s(?<resptime>\d+)"   | rangemap field=resptime Lessthan1Sec=0-1000 One_to_ThreeSec=1001-3000 higher_than_three=3001-10000 default="greater_Than_10k" | timechart count by range 

Now, this works fine for one host but unfortunately we want this data for multiple hosts and I am not able to list the time ranges for multiple hosts. Can anyone please help me here.

0 Karma

somesoni2
Revered Legend

Give this a try

 index=* host=hostname sourcetype=perf*  "*string pattern*"  | rex "GET.*\s(?<resptime>\d+)"   | rangemap field=resptime Lessthan1Sec=0-1000 One_to_ThreeSec=1001-3000 higher_than_three=3001-10000 default="greater_Than_10k" | eval host=host.":".range | timechart count by host
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...