문제

If I get this line in Splunk,

abcd HTTP/1.1 200 0 231 edfg 

How can I get 231 this number?

I have lots of lines like this. How can I get the number from each line and draw a graph based on these numbers? Thanks.

도움이 되었습니까?

해결책

| rex field=_raw "HTTP/1.1 \d+ \d+ (?<some_field_name>\d+)" | timechart avg(some_field_name) as Average
라이센스 : CC-BY-SA ~와 함께 속성
제휴하지 않습니다 StackOverflow
scroll top