Refine your search:

Here is a snippet from my logfile:

Mar 24 01:31:11,388  INFO [0x41401960]: NoSnmpMibInstance: CountWorker.ProcLoTimes = 11628^8861^1.31^0^291

I want to pull the number in between the 2nd and 3rd caret, create field called "plavg" and graph the values along the X axis:

| rex field=_raw "CountWorker.ProcLoTimes\s+=\s+\d+\^\d+\^(?<plavg>[^\^]+)" | timechart values(plavg)

The regex is working but the timechart is not. How do I graph the values from my logfile on a timechart? Do I have to convert the "1.31" from a string to a number?

Thanks in advance.

asked 28 Mar '11, 02:49

tgow's gravatar image

accept rate: 18%

edited 28 Mar '11, 03:08

southeringtonp's gravatar image

southeringtonp ♦

One Answer:

Timechart was putting the data into 10 minute buckets by default and the time interval for the events was less than a minute. This resulted in multiple values per time interval so it wouldn't graph. Here is search that worked:

| rex field=_raw "CountWorker.ProcLoTimes\s+=\s+\d+\^\d+\^(?[^\^]+)" | timechart span=30s values(plavg)

You have to use values because timechart needs a function before the field.


answered 28 Mar '11, 14:51

tgow's gravatar image

accept rate: 18%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions



Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported



Asked: 28 Mar '11, 02:49

Seen: 2,839 times

Last updated: 28 Mar '11, 14:51

Copyright © 2005-2014 Splunk Inc. All rights reserved.