Hi,
I am having trouble finding a good way of parsing through my log entries to try and grab the key-value pairs for plotting on a graph.
To be clear, I get one log a day in the format:
2016-06-03 05:00:00 date=201606030000 [Audit Report],ad=998,adExtension=0,adGroup=160,adunit=0,advertiser=0,advertiserFunds=0,app=0,bidModifier=0,campaign=0,control=0,dataDictionary=1,demandDefinition=0,forexVersion=0,fundTransaction=0,publisher=0,section=0,site=0,summary=0,supplyDefinition=0,targetingAttribute=3682,trackingPixel=0
I want to generate a graph where I have a line graph
x-axis = Date
y-axis = value
I want a line representing the value for each key for each date so that I can observe the trends for each key (i.e. the ad, adExtension, adunit, etc.)
However, I'm having trouble finding a good way of filtering out only the bolded section in the example log so that I can use it for graphing. I also have the flexibility of changing the format of my log if that would be the best solution.
Help is greatly appreciated.
Thanks!
Assuming that Splunk is able to parse the timestamp which is at the start of event and setting _time field with that, then try this
your base search | _time ad* app bid...listall available fields ... | timechart span=1d values(*) as *