How can a school, college or university acquire Splunk license if they want to educate their students about the tool? ... View more

I have two fields field1 as response time field 2 as instance name I want to plot the response time by instance name and overlay the average response time of a single instance name. Data is like Instance1 responsetime1 Instance1 responsetime2 : Instance1 responsetimeN Instance2 responsetime1 Instance2 responsetime2 : Instance2 responsetimeN : and so on. So I want chart of responsetime by instance name and an overlay line of avg(responsetime) of only single instance say instance5 Can you please help. ... View more

I have a json raw string from which I have to extract the "msg" key and pair value. Can you please assist. The log line looks like below: <6>2015-11-26T17:00:15Z x45678fnjotq5 doe[88]: {"ddcfa_app_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsa","ddcfa_app_name":"paymentManagementApplication","ddcfa_org_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsasdas63g3664-s35d-33sfa","ddcfa_space_name":"noShowMessage","event_type":"LogMessage","level":"info","message_type":"OUT","msg":"DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()","origin":"rep","source_instance":"0","source_type":"APP","time":"2015-11-26T17:00:15Z","timestamp":1477069200012312311} I want to extract "msg" field's "value": DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily() ... View more