scenario:
have pushed snmp poll data as an event to splunk as a TCP source.
event format = "parameterId=paramterValue"
event source = SNMPTCP
to-do: need to find minute average of "parameterValue" for a particular "parameterId"
sample event data:
Timestamp event data
5:44:13.000 PM 908=51
5:43:58.000 PM 908=14
5:43:47.000 PM 908=18
5:43:36.000 PM 908=49
5:43:25.000 PM 908=88
5:43:14.000 PM 908=80
5:42:58.000 PM 908=98
5:42:47.000 PM 908=55
5:42:36.000 PM 908=43
5:42:20.000 PM 908=13
when given as a minute wise report
search query - "sourcetype="SNMPTCP" | timechart span 1m count"
5.42 - 4
5.43 - 5
5.44 - 1
but to calculate the parameterValue as follows,
5.42 - ( 13 + 43 + 55 + 98 ) / 4 = 52
5.43 - ( 14 + 18 + 49 + 88 + 80 ) / 5 = 49.8
5.44 - 51 / 1 = 51
what is the query to be executed. i tried extract command but in vain. A sample command will be really helpful.
thanks in advance.
Hello
First you´ll need to extract the values with, rex command, something like:
... | rex field=_raw " 908=(?<myvalue>\d+)" | ...
Then you should have a new field to use called "myvalue" and then you only need to make a search like:
sourcetype="SNMPTCP" | timechart span 1m avg(myvalue)
So combining both:
sourcetype="SNMPTCP" | rex field=_raw=" 908=(?<myvalue>\d+)"| timechart span 1m avg(myvalue)
Regards
gfuente,
is it possible to achieve the same result by using kv/extract command instead of rex?
if possible please share.
thanks for the prompt reply gfuente.