Splunk Search

timeline chart

Rkp_splunk
Engager

Hi 

I have got this log where it shows how much time it takes to load investor page in millisecond(ms)

2021-09-15 13:40:12,005 {c0cf807e-ee8b-4bd7-bf10-b586302ce001} XYZ/Online/0659251190 END [/investor/load.htm] (5498) - 3312ms

 

I want to create a timeline chart to show how string "END [/investor/load.htm]" takes time to load at different period. I have got timepicker so I can get but how to show timeline for this string.

SPL like

index=prd_applog OR index=prd_middleware) appid::a0061f sourcetype="btsfl:bti:audit"| search "END [/investor/load.htm]" | timechart span=1m  <then something to be added here like regex to give that timeline>

 

Thanks

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Extract the load time into a field then let timechart graph it.

index=prd_applog OR index=prd_middleware) appid::a0061f sourcetype="btsfl:bti:audit" "END [/investor/load.htm]" 
| rex "- (?<loadTime>\d+)ms"
| timechart span=1m max(loadTime) as MaxLoadTime
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Extract the load time into a field then let timechart graph it.

index=prd_applog OR index=prd_middleware) appid::a0061f sourcetype="btsfl:bti:audit" "END [/investor/load.htm]" 
| rex "- (?<loadTime>\d+)ms"
| timechart span=1m max(loadTime) as MaxLoadTime
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...