Wow! That's bloody awesome! Thank you so much! Side question ... is there a way in the search terms to tell the graph to be line type instead of the default? ... View more

Easiest would be | rex field=_raw ".*duration\s\[(?<duration>.*?)\]" This will capture everything in between the [] after the word "duration". So in your examples, it would be "1.1s", "999ms", and "814ms". Is that what you're looking for? ... View more

small update on the regex, this will not include the \/ in the value of field: (? \w{64}) ... View more

now today ... for the 25th, three of the four logs are vanished! Even last night there were three of the four logs ... two more went missing overnight!!!! this is insane. $ splunklogchk Thu Mar 1 19:04:37 GMT 2012 - Splunk prod logs for the last 7 days summary ... updated=Fri 24 Feb 2012 06:30:18 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/apache/FEB23/extended_log updated=Fri 24 Feb 2012 06:21:53 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/apache/FEB23/extended_log updated=Fri 24 Feb 2012 06:37:57 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/tomcat/FEB23/catalina.out updated=Fri 24 Feb 2012 06:25:59 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/tomcat/FEB23/catalina.out updated=Sat 25 Feb 2012 05:39:40 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/apache/FEB24/extended_log updated=Sat 25 Feb 2012 05:37:17 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/apache/FEB24/extended_log updated=Sat 25 Feb 2012 05:43:26 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/tomcat/FEB24/catalina.out updated=Sat 25 Feb 2012 05:38:00 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/tomcat/FEB24/catalina.out updated=Sun 26 Feb 2012 09:49:25 PM GMT, source=/opt/prod_log_spool/sjctricwa03p/tomcat/FEB25/catalina.out *** *** three logs missing here *** updated=Mon 27 Feb 2012 05:25:37 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/apache/FEB26/extended_log updated=Mon 27 Feb 2012 05:26:13 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/tomcat/FEB26/catalina.out updated=Tue 28 Feb 2012 05:01:22 PM GMT, source=/opt/prod_log_spool/sjctricwa03p/tomcat/FEB26/catalina.out *** 1 log missing here updated=Tue 28 Feb 2012 05:39:55 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/apache/FEB27/extended_log updated=Tue 28 Feb 2012 05:38:14 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/apache/FEB27/extended_log updated=Tue 28 Feb 2012 05:41:23 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/tomcat/FEB27/catalina.out updated=Tue 28 Feb 2012 05:39:10 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/tomcat/FEB27/catalina.out updated=Wed 29 Feb 2012 07:50:42 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/apache/FEB28/extended_log updated=Wed 29 Feb 2012 05:37:57 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/apache/FEB28/extended_log updated=Thu 01 Mar 2012 02:09:33 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/tomcat/FEB28/catalina.out updated=Wed 29 Feb 2012 05:38:48 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/tomcat/FEB28/catalina.out updated=Thu 01 Mar 2012 09:45:06 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/apache/FEB29/extended_log updated=Thu 01 Mar 2012 09:47:11 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/apache/FEB29/extended_log updated=Thu 01 Mar 2012 09:48:38 AM GMT, source=/opt/prod_log_spool/sjctricwa04p/tomcat/FEB29/catalina.out updated=Thu 01 Mar 2012 09:46:39 AM GMT, source=/opt/prod_log_spool/sjctricwa03p/tomcat/FEB29/catalina.out ... View more

We were discussing this in #splunk IRC, and the missing pipe character before rex in the question/example turned out to be the real culprit. ... View more