I am newbie to splunk Data is json output {"fdc": {"available": 1248, "unavailable": 0, "undefined": 0}, "mwdc": {"available": 6459, "unavailable": 0, "undefined": 17}, "dev": {"available": 277, "unavailable": 0, "undefined": 1}, "ct2": {"available": 1352, "unavailable": 0, "undefined": 0}, "ast": {"available": 0, "unavailable": 0, "undefined": 0}, "Timestamp": "Friday, 07. July 2017 12:20PM", "mwdc2": {"available": 1616, "unavailable": 0, "undefined": 0}, "uat": {"available": 219, "unavailable": 0, "undefined": 0}, "swdc": {"available": 3672, "unavailable": 0, "undefined": 3}, "gtdc": {"available": 8532, "unavailable": 1, "undefined": 4}, "gtdc2": {"available": 5403, "unavailable": 0, "undefined": 12}, "rdc": {"available": 2331, "unavailable": 0, "undefined": 0}} i need a time series chart for each of these location like FDC three line chart available / unavailable / undefined. index=some_index sourcetype="json:status_data"|spath ast.available |spath ast.unavailable |spath ast.undefined i get for ast the fields but how to make for each site and their respective line graph ... View more

Fri Feb 22 20:52:59 2013 390603 : Failure during SQL operation to the database : ORA-00942: table or view does not exist (ARERR 552) Fri Feb 22 20:52:59 2013 390603 : Failure during SQL operation to the database : ORA-00942: table or view does not exist (ARERR 552) Fri Aug 31 16:54:19 2012 Sig-Cancelled - AP:Signature - 000000000031602|000000000017692 Fri Aug 31 16:54:19 2012 Approve : Operation cancelled due to error (ARAPPNOTE 4502) Fri Aug 31 16:54:19 2012 Sig-Cancelled - AP:Signature - 000000000023551|000000000014287 Fri Aug 31 16:54:19 2012 Approve : Operation cancelled due to error (ARAPPNOTE 4502) is the sample data. looking to extract only last field within ( ) error code and the text before it starting from :.*(AR* 111) tried several rex and extraction as the data but no luck. looking for help thanks Sri ... View more