Splunk Search

timechart call Time

area34
New Member

Hi,

I tried to made a timechart (call duration) , the value I onyl have is the Users and the methods and the call timestamp. I want see how long the call takes with the user again one method?

thats my datas

timestamp user method

2020-04-15 07:18:28.978 WSABXXX checkXXXX

0 Karma

to4kawa
Ultra Champion
index=yours
| eval timestamp=strptime(timestamp,"%F %T.%3Q")
| stats range(timestamp) as duration by user method

area34
New Member

my search
| rex field=msg "(?\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}).- \w{5}.\w{5}.\w{7}.\w{10}.(?P.)- user=(?.*)- method=(?\w+)"
| eval timeStamp=strptime(timestamp,"%F %T.%3Q")
| stats range(timeStamp) as call by user method

my result
user method call
1 WSxxx checkmethod
2 WSyyy getmethod
3 WStztzz getOBmethod

Now in the the field call is empty I want that field should count how often the user called method

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="raw
2020-04-15 07:18:28.978 WSABXXX checkXXXX
2020-04-15 08:18:28.968 WSABXXX checkXXXX"
| multikv forceheader=1
| rex "(?<timestamp>\S+\s\S+).(?<user>\S+).(?<method>\S+)"
| eval timeStamp=strptime(timestamp,"%F %T.%3Q")
| stats range(timeStamp) by user method

Check your REGEX and |eval timeStamp) ...result.

0 Karma

area34
New Member

Hi,

yeah now I want the the calls the field is empty...

index=*

| rex field=msg "(?\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}).- \w{5}.\w{5}.\w{7}.\w{10}.(?P.)- user=(?.*)- method=(?\w+)"
| eval timeStamp=strptime(timestamp,"%F %T.%3Q")
| stats range(timeStamp) as call by user action

sourc
|
|
V

user    method call

1 WSxxx checkmethod
2 WSyyy getmethod
3 WStztzz getOBmethod

what should I do if I want

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...