Hi,
I'm a novice to more advanced Splunk usage, but I understand that a lot is possible.
Here is an example of a log entry in our JSON based logs:
{
"date": "2016-10-04T08:39:55.274Z",
"gameId": "coolgame",
"logLevel": "STAT",
"levelId": "6001",
"sessionId": "1456878-X1GTRER",
"category": "stat",
"type": "orientationChange",
"message": [
{
"phase": "respawn",
"orientation": "landscape",
"timeSpentMs": 2000,
"gameRound": 1
}
],
"serverData": {
"clientIp": "10.72.14.250"
},
"timestamp": 1475570395274
}
Here is a description of the interesting parts:
type
is the type of log message, here only "orientationChange"
message.phase
could be respawn|ingame|pausedmessage.orientation
could be landscape|portraitmessage.gameRound
is a positive integermessage.timeSpentMs
is a positive integer indicating nr of ms spent in landscape
|portrait
modesessionId
a string unique for that game session, it spans multiple gameRoundstimestamp
is an integer indicating the time when the log entry was createdA log entry like the one above will be created when any of these changes:
message.phase
message.orientation
message.gameRound
is a positive integerAn example
{ ... "sessionId": "1456878-X1GTRER", "message": [{"phase": "respawn","orientation": "landscape","timeSpentMs": 4000,"gameRound": 1}], ... "timestamp": 1000000000000 }
{ ... "sessionId": "1456878-X1GTRER", "message": [{"phase": "ingame" ,"orientation": "landscape","timeSpentMs": 1000,"gameRound": 2}], ... "timestamp": 1000000001000 }
{ ... "sessionId": "1456878-X1GTRER", "message": [{"phase": "ingame" ,"orientation": "portrait", "timeSpentMs": 20000,"gameRound": 2}], ... "timestamp": 1000000021000 }
{ ... "sessionId": "1456878-X1GTRER", "message": [{"phase": "paused" ,"orientation": "portrait", "timeSpentMs": 60000,"gameRound": 2}], ... "timestamp": 1000000081000 }
Here the user entered the game (respawn) in landscape mode. After four seconds the next game round was started (ingame). After one more second the user realized that he wanted to play the game in portrait mode and changed to that orientation. He then played the game for 20 seconds and then paused it for 1 minute.
Following are the two types of information I need and my rough ideas on how to get them:
landscape
/portrait
mode for the three phase
s?
type
"orientationChange"
message.phase
and summarize message.timeSpentMs
landscape
/portrait
, see the number of gameRounds
played completely in one orientation without any orientation change?
type
"orientationChange"
message.gameRound
where all entries in the gameRound
has stayed in one orientation
gameRounds
in orientation
portrait
/landscape
Questions:
For requirement 1 try like this
index=foo sourcetype=bar type="orientationChange"
| chart sum(message.timeSpentMs) over message.phase by message.orientation
For requirement 2, try this
index=foo sourcetype=bar type="orientationChange"
| chart count over message.gameRound over message.orientation
Json is Splunk recommended data format and since it's linear (not array), IMO it's efficient.
The only better way could be to convert JSON to linear keyvalue pair.
For requirement 1 try like this
index=foo sourcetype=bar type="orientationChange"
| chart sum(message.timeSpentMs) over message.phase by message.orientation
For requirement 2, try this
index=foo sourcetype=bar type="orientationChange"
| chart count over message.gameRound over message.orientation
Json is Splunk recommended data format and since it's linear (not array), IMO it's efficient.
The only better way could be to convert JSON to linear keyvalue pair.