We have following entries in our app log: 2013-12-06 09:09:23,918 Level=INFO Thread=http-apr-45082-exec-2 Logger=c.e.l.l.TestTracking MessageUUID=f2823947-ebc7-449d-b774-816354fc29ea MessageName=RandomGet MessageVersion=1.0 UserUUID=f2823947-ebc7-449d-b774-816354fc29ea SessionUUID=f2823947-ebc7-449d-b774-816354fc29ea IPAddress=127.0.0.1 Message="RequestSerialization=11887,CacheGetTotalTime=179544,ResultsDeserialization=61,TotalTime=800392," I want to timechart TP99 and need help with the splunk query. Here's my attempt which is not yielding any result. host=Testserv* source=/var/log/tomcat/myapp/app.log Level=INFO | rex max_match=100 field=Message "(?P<metricdata>[^,]+)[,]" | table metricdata | mvexpand metricdata | rex field=metricdata "(?<metric>\w+)=(?<latencyus>\d+)" | where latencyus>0 | eval latency=latencyus/1000 | search metric="TotalTime"| timechart span=15m exactperc99(latency), exactperc99.9(latency) ... View more

I am trying to construct from my log which logs sla tracking metrics like below: Message="Metric1=11887,Metric2=179544,Metric3=157892,Metric4=61,Metric5=3438" Here's the query I am trying with. host=testmachine* INFO source=/var/log/tomcat/test/app.log | rex max_match=100 field=Message "(? \w+)=(? \d+) us," | stats avg(latency) by metric With the above query, the aggregation seem to be happening across all the matches, i.e. all the metric show the same value of avg(latency). Is there a way I can relate the metric and latency together? ... View more