Splunk Search

How to generate a chart based on Duration (x-axis) and timestamp (y-axis)?

chanamoluk
Explorer

How to generate a chart based on Duration (x-axis) and timestamp (y-axis)?

12/19/2016 10:30:53 AM
LogName=JHApplication
... 7 lines omitted ...
RecordNumber=23080258
Keywords=Classic
Message=Action=ConsumeMessage, ConsumerType=InprocConsumer, ConsumerTypeName=WorkflowEndpoint, ConsumerMethodName=CustomerUpdateResponse, ConsumerParam=XmlNode, MessageId=1b411832-3625-4c19-aaf6-22a258a4dabd\1844534213, Duration=0.0284597

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Strange. It's in standard key value pair format and should've been extract. Try something like this

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |stats values(Duration) as Duration by _time

OR

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |timechart avg(Duration) as Duration

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Strange. It's in standard key value pair format and should've been extract. Try something like this

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |stats values(Duration) as Duration by _time

OR

index=* host=*MQ004 Duration | rex "Duration=(?<Duration>\d+(\.\d+)*)" |timechart avg(Duration) as Duration
0 Karma

chanamoluk
Explorer

thank you so much.... its working

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search | stats values(Duration) as Duration by _time
0 Karma

chanamoluk
Explorer

index=* host=*MQ004 Duration|stats values(Duration) as Duration by _time

it is showing only the _time but it is not displaying the Duration value, every minute it is generating 10 to 20 messages

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Is Duration field already extracted (can you see the field Duration in the field sidebar)? If not then try something like this

0 Karma

chanamoluk
Explorer

no i can't see Duration field on the left side

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...