Splunk Search

Creating a Tabular report

runiyal
Path Finder

I have following output in the logfile -

The service /app/service/upload succeeded in 1.264000 seconds, Request: {usertext=userText, date=2016-08-03, uploadedBy=appuser, usertext=userText, location=c:\store\abc.pdf, system=App1, envName=local, folderNumber=test12345, uploadedDate=2016-08-02}, Response: {UUID=5b626db2-1e9e-4a6b-b4a7-6f91e45111b4, MIMETYPE=application/pdf, SIZE=65.0615234375 KB, DBID=156251}

Need to have a report like this -

                Total   Response Time (Sec) Size of Document (KB)
Application Uploads Min Max Avg   Min   Max Avg
App1             1000    .5 11.5    1.5   20    2150    80  
App2             500       1     20   2    50   3750    100 
App3             5500    .2  7.5     1     10   1750    50  

Can you gurus help in creating a script for such outputs?

Tags (1)
0 Karma

runiyal
Path Finder

Thanks a lot Rich. Works like a charm!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

index=foo | rex "in (?<respTime>\d+\.\d+) seconds.*system=(?<Application>[^,]+).*SIZE=(?<sizeKB>\d+\.\d+)" | stats count as TotalUploads min(respTime) as MinRespTime max(respTime) as MaxRespTime avg(respTime) as AvgRespTime min(sizeKB) as MinSize max(sizeKB) as MaxSize avg(sizeKB) as AvgSize by Application
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...