Hi Splunk Community! Quick one for all you experts!
I'm trying to timechart the following 4 separate metrics (representing a threading model and latency in nanoseconds). I don't get any results back when performing the below, but when i search for just for Max1 and search Thread:1(obviously just using timechart for Max1, it plots fine
FullRunLatency sourcetype="my-logs" source="/var/tmp/mylogs.log*"
| rex field=source "prototype(?.*?)_"| search Thread:1
|rex "Latency.* Max: (?.*?)ns"
| rex field=source "prototype(?.*?)_"| search Thread:2
|rex "Latency.* Max: (?.*?)ns"
| rex field=source "prototype(?.*?)_"| search Thread:3
|rex "Latency.* Max: (?.*?)ns"
| rex field=source "prototype(?.*?)_"| search Thread:4
|rex "Latency.* Max: (?.*?)ns"
| timechart max(Max1), max(Max2), max(Max3), max(Max4) by instance span=1m
Any ideas? Thanks in advance
The issue you are having is because you have a | search Thread:1
, all other threads are being discarded after that point.
You probably need to incorporate the Thread:1
etc... into your rex
statement. Can you provide some log samples.
The issue you are having is because you have a | search Thread:1
, all other threads are being discarded after that point.
You probably need to incorporate the Thread:1
etc... into your rex
statement. Can you provide some log samples.