{"id":50188,"date":"2022-01-18T17:42:47","date_gmt":"2022-01-18T17:42:47","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=50188"},"modified":"2022-01-18T17:42:47","modified_gmt":"2022-01-18T17:42:47","slug":"answer-by-warren-for-splunk-how-to-get-a-timechart-regarding-the-extracted-_time-values-for-which-range-was-applied","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=50188","title":{"rendered":"Answer by warren for Splunk: How to get a timechart regarding the extracted _time values for which range() was applied?"},"content":{"rendered":"

timechart<\/code><\/a> requires the hidden field _time<\/code> still exist – in this example, there is no _time<\/code> field<\/p>\n

So you’re going to need to "fake" your timechart<\/a> – or you’re going to need to get _time<\/code> back somehow or other<\/p>\n

Something along these lines should work:<\/p>\n

index=ndx ("Request" OR "Response")\n| rex field=_raw "id\\":\\"(?<id>[a-z0-9-]+)" \n| stats min(_time) as Requesttime, max(_time) as Responsetime, range(_time) as diff by id date_minute\n| stats avg(diff) as avg by id date_minute\n<\/code><\/pre>\n
(I took out the extraneous first | table<\/code> line, as it slows the search down, and | stats<\/code> will yield a table when it’s completed)<\/p>\n
from User warren – Stack Overflow https:\/\/stackoverflow.com\/questions\/70753282\/splunk-how-to-get-a-timechart-regarding-the-extracted-time-values-for-which-ra\/70760078#70760078
\nvia IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
timechart requires the hidden field _time still exist – in this example, there is no _time field So you’re going to need to "fake" your timechart – or you’re going to need to get _time back somehow or other Something along these lines should work: index=ndx ("Request" OR "Response") | rex field=_raw "id\\":\\"(?<id>[a-z0-9-]+)" | stats …
Continue reading Answer by warren for Splunk: How to get a timechart regarding the extracted _time values for which range() was applied?<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-50188","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/50188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=50188"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/50188\/revisions"}],"predecessor-version":[{"id":50189,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/50188\/revisions\/50189"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=50188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=50188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=50188"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=50188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}