Hi, so given a log including TwoHundred=5
it's pretty easy to make a timechart with a sum(TwoHundred)
command. However, my logs are http responses, so they look like 200=5
and the sum(200)
does not return results on the graph. Any idea of something that will tell splunk that the 200 is intended as a string?
Hello
Try with: sum($200$)
Regards
also if you don't mind me asking, what does $ do?
hmm i really like the ideas you're coming up with but again that one produced no chart:/
Ok
And with a rename like:
...| rename $200$ as http_status | timechart sum(http_status)
??
This is along the lines of what i was looking for, however just like sum(200), nothing is displayed on the timechart:( it turns up in the search if i look at the table though!