I've got a scripted input that dumps a line like the following every minute:
2011-12-22 08:46:56,0,30,6
What I'd like to do is parse it for a stacked timechart as follows:
Datestamp, Critical, Error, Warning
I know the comma is my delimiter, but beyond that I'm kind of at a loss. Any help?
Self-answering:
sourcetype="my_custom_sourcetype" | timechart sum("Critical"),sum("Error"),sum("Warning") by time
Self-answering:
sourcetype="my_custom_sourcetype" | timechart sum("Critical"),sum("Error"),sum("Warning") by time
Update: I managed to use the IFX to correctly parse the fields so Critical/Error/Warning are being counted. Now I need to figure out how to do the stacked area chart based on COUNT(Critical),COUNT(Error),COUNT(Warning) for each time the script generates a row.