質問

If I get this line in Splunk,

abcd HTTP/1.1 200 0 231 edfg 

How can I get 231 this number?

I have lots of lines like this. How can I get the number from each line and draw a graph based on these numbers? Thanks.

役に立ちましたか?

解決

| rex field=_raw "HTTP/1.1 \d+ \d+ (?<some_field_name>\d+)" | timechart avg(some_field_name) as Average
ライセンス: CC-BY-SA帰属
所属していません StackOverflow
scroll top