timechart count by -not a legit field-

[mitcanmit]

Hi,

I want to show the stats based on the different values of the "state" field. "timechart count by result" does not work -probably because the format is not json and splunk fails to understand that "state" is a field. How do I handle this? I have tried rex function but did not manage to get the results I need.

I am trying to get something like this:
success=1231
aborted=322
pending=111

Thanks in advance for the help.

HTTP ***
Headers: [{'Cache-Control',"max-age=0, no-cache"},
          {'Content-Length',"400"},
          {'Content-Type',"application/json;charset=utf-8"},
          {'Host',"***"},
          {'Pragma',"no-cache"},
          {'X-Forwarded-For',"***"}]
Body: [{amount,***},
       {client_reference,"***"},
       {connector,"**"},
       {connector_reference,"***"},
       {consumer_save_card,false},
       {credit_card,[{brand,"***"},
                     {card_number,"**"},
                     {exp_month,***},
                     {exp_year,***},
                     {holder,"***"},
                     {type,"***"}]},
       {currency,"***"},
       {gateway_reference,"***"},
       {state,"success"}]

[tpflicke · Accepted solution]

The following should do the trick though producing the regular stats output format:

... | rex field=_raw "\{state,\"(?<state>\w*)" | stats count by state | sort -count

or with timechart:

... | rex field=_raw "\{state,\"(?<state>\w*)" | timechart count by state

[mitcanmit]

Thanks a lot!