Here is a snippet from my logfile:
I want to pull the number in between the 2nd and 3rd caret, create field called "plavg" and graph the values along the X axis:
The regex is working but the timechart is not. How do I graph the values from my logfile on a timechart? Do I have to convert the "1.31" from a string to a number?
Thanks in advance.
Timechart was putting the data into 10 minute buckets by default and the time interval for the events was less than a minute. This resulted in multiple values per time interval so it wouldn't graph. Here is search that worked:
| rex field=_raw "CountWorker.ProcLoTimes\s+=\s+\d+\^\d+\^(?[^\^]+)" | timechart span=30s values(plavg)
You have to use values because timechart needs a function before the field.
answered 28 Mar '11, 14:51