|
Here is a snippet from my logfile: I want to pull the number in between the 2nd and 3rd caret, create field called "plavg" and graph the values along the X axis: The regex is working but the timechart is not. How do I graph the values from my logfile on a timechart? Do I have to convert the "1.31" from a string to a number? Thanks in advance. |
One Answer:
|
Timechart was putting the data into 10 minute buckets by default and the time interval for the events was less than a minute. This resulted in multiple values per time interval so it wouldn't graph. Here is search that worked: | rex field=_raw "CountWorker.ProcLoTimes\s+=\s+\d+\^\d+\^(?[^\^]+)" | timechart span=30s values(plavg) You have to use values because timechart needs a function before the field. |