Splunk Search

How to chart extracted name value pairs across multiple events?

paul_schofield
Engager

I have a set of events that look like this. (Each line is a different event)

a:2
b:1
c:5
a:6
d:3
b:9

I am trying to graph the values of each field over time, how do I extract the name value pairs and then manipulate them to make a chart using stats?

I can extract each name value pair but not sure how to use them as a group by in the chart. The names will be variable and change over time.

I've tried things like this: <search> | rex ",(?\w+.*:\d+)$" | makemv delim=":" ciMV | eval ciSort=mvindex(ciMV,0)

What am I missing?

0 Karma

ankireddy007
Path Finder

You can try like this

 <search> | rex "(?<server>\w+):(?<cpu>\d+)" |timechart avg(cpu) by server

martin_mueller
SplunkTrust
SplunkTrust

Based on your sample data you'd do this:

base search | rex "a:(?<a>\d+)" | rex "b:(?<b>\d+)" | rex "c:(?<c>\d+)" | rex "d:(?<d>\d+)" | timechart avg(a) avg(b) avg(c) avg(d)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If the number and names are arbitrary, and the names basically are values as well (saying "this measurement was taken on server X") then you should use @ankireddy007's answer, extracting both as a value and charting one value grouped by the other.

In general you could have Splunk extract the field name as well in transforms.conf, but in this case that wouldn't be good practice because the field name is essentially a value, not a field name.

paul_schofield
Engager

Thanks martin_mueller. The names in the name/value pairs are variable, so I don't know that it is an a, b, or c, so it could be any string. It's actually a bunch of server names with their cpu values and remember I have an event per line. How to extract and group and trend all of the values per server name?

Thanks, Paul

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...