How to chart extracted name value pairs across multiple events?

[paul_schofield]

I have a set of events that look like this. (Each line is a different event)

a:2
b:1
c:5
a:6
d:3
b:9

I am trying to graph the values of each field over time, how do I extract the name value pairs and then manipulate them to make a chart using stats?

I can extract each name value pair but not sure how to use them as a group by in the chart. The names will be variable and change over time.

I've tried things like this: <search> | rex ",(?\w+.*:\d+)$" | makemv delim=":" ciMV | eval ciSort=mvindex(ciMV,0)

What am I missing?

[ankireddy007]

You can try like this

 <search> | rex "(?<server>\w+):(?<cpu>\d+)" |timechart avg(cpu) by server

[martin_mueller]

Based on your sample data you'd do this:

base search | rex "a:(?<a>\d+)" | rex "b:(?<b>\d+)" | rex "c:(?<c>\d+)" | rex "d:(?<d>\d+)" | timechart avg(a) avg(b) avg(c) avg(d)

[martin_mueller]

If the number and names are arbitrary, and the names basically are values as well (saying "this measurement was taken on server X") then you should use @ankireddy007's answer, extracting both as a value and charting one value grouped by the other.

In general you could have Splunk extract the field name as well in transforms.conf, but in this case that wouldn't be good practice because the field name is essentially a value, not a field name.

[paul_schofield]

Thanks martin_mueller. The names in the name/value pairs are variable, so I don't know that it is an a, b, or c, so it could be any string. It's actually a bunch of server names with their cpu values and remember I have an event per line. How to extract and group and trend all of the values per server name?

Thanks, Paul