Question

If I get this line in Splunk,

abcd HTTP/1.1 200 0 231 edfg 

How can I get 231 this number?

I have lots of lines like this. How can I get the number from each line and draw a graph based on these numbers? Thanks.

Était-ce utile?

La solution

| rex field=_raw "HTTP/1.1 \d+ \d+ (?<some_field_name>\d+)" | timechart avg(some_field_name) as Average
Licencié sous: CC-BY-SA avec attribution
Non affilié à StackOverflow
scroll top