Splunk Search

Chart field value over time

alebaffajp
Engager

Hi,
I am very new to Splunk and I would like to make a graph that shows the average value of response_time over the time (it can be 1 day to N-days). The log I have is like the one here below and it comes from some web API.

1 2017-08-02T01:10:06.949467+00:00 loggregator 43534534 - - myawesomewebsite.net - [02/08/2017:01:10:06.914 +0000] "GET /v1.0/myawesomeAPI HTTP/1.1" 403 0 112 "-" "curl/7.35.0" "127.0.0.1:345345" response_time:0.034484842 app_id:"44444" 

In my query search I just need to consider all the events, so I guess it would be something like ** response_time*. I tried different things, but I always get nothing.

Thank you very much in advance for any help! Love Splunk!

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi alebaffajp,

index=_your_index sourcetype=your_sourcetype
| rex "response_time:(?<response_time>[^ ]*)"
| timechart span=1d avg(response_time)

If you extract response_time field, you don't need of the rex command in the search.

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi alebaffajp,

index=_your_index sourcetype=your_sourcetype
| rex "response_time:(?<response_time>[^ ]*)"
| timechart span=1d avg(response_time)

If you extract response_time field, you don't need of the rex command in the search.

Bye.
Giuseppe

alebaffajp
Engager

Thank you very much! It works! Grazie 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...