Refine your search:

1
1

I have composite counters for latency in the form "latency=1.0/3.0/5.0ms" which are min/avg/max respectively.

I would like to be able to graph these individually, something like the graph below.

I think I should be able to remove the units ("ms") and break these up at search time into components (perhaps: latency.min, latency.avg, latency.max) using a regex. I was hoping someone would be kind enough to show me how this can be done, or perhaps something similar.

graph of composite variable

asked 27 Apr '12, 14:43

charleswheelus's gravatar image

charleswheelus
6415
accept rate: 100%


2 Answers:

OK, now I got it to work. Thanks yannK. When viewing your underlying answer, I see all the backslashes needed. (I was only using the backslash before the slashes)

Just to make other readers life easier (you can cut and paste the code below):

mysearch latency | rex "latency=(?<minlatency>\d+.\d+)\/(?<avglatency>\d+.\d+)\/(?<maxlatency>\d+.\d+)ms" | table _time minlatency avglatency maxlatency

To build the graph try this:

mysearch latency | rex "latency=(?<minlatency>\d+.\d+)\/(?<avglatency>\d+.\d+)\/(?<maxlatency>\d+.\d+)ms" | table _time minlatency avglatency maxlatency | timechart min(minlatency) avg(avglatency) max(maxlatency) 

link

answered 30 Apr '12, 11:32

charleswheelus's gravatar image

charleswheelus
6415
accept rate: 100%

edited 30 Apr '12, 13:08

if your event has "latency=1.0/3.0/5.0ms" then try

mysearch latency | rex "latency=(?<minlatency>d+.d+)/(?<avglatency>d+.d+)/(?<maxlatency>d+.d+)ms" | table _time minlatency avglatency maxlatency
display as line graph

edit, beware the web messed up the display, between the counteers, use an escaping backslash before the slash.

link

answered 27 Apr '12, 15:15

yannK's gravatar image

yannK
13.5k823
accept rate: 31%

edited 27 Apr '12, 15:17

I tried this but it did not work. I substituted "\/" for "/" which produced three empty columns minlatency, avglatency, and maxlatency. Going to dig into the rex command in the manual to see if I can figure out the correct incantation. Thanks for pointing me in the right direction.

(30 Apr '12, 09:49) charleswheelus

look at the "edited x days ago" link to see the correct command, the forum rendering is messing up the search command.

(30 Apr '12, 09:53) yannK
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×471
×13
×4
×2
×2

Asked: 27 Apr '12, 14:43

Seen: 644 times

Last updated: 30 Apr '12, 13:08

Copyright © 2005-2012 Splunk Inc. All rights reserved.