Splunk:Reports:Jira - lbonanomi/notes GitHub Wiki

index=jira sourcetype=access_logs | rex field=_raw "(.+?\s){2}(?<user>.+?)\s" | rex field=_raw ".*(\d{3}\s\d+)\s(?<clock>\d+)\s" | search user ="X"| eval clock=(clock/1000) | timechart avg(clock) span=1s

index=jira sourcetype=access_logs "/rest/api" | eval tent=if(like(field10, "https://YOUR.DOMAIN.NAME%"), "Referred", "Direct") | search tent=Direct | eval seive=if(like(field11, "Mozilla%"), "Browser", "Bot") | search seive=Bot | timechart count(field3) by field3 span=1m

index=jira sourcetype=access_logs | rex field=_raw "(.+?\s){2}(?<user>.+?)\s" | rex field=_raw ".*(\d{3}\s\d+)\s(?<clock>\d+)\s" | rex field=_raw ".*\]\s\"(?<target>.+?)\"\s" | eval clock=(clock/1000) | where user != "-" | rex field=target "(?<verb>.+?)\s(?<turnip>.+?)\sHTTP" | eval temp=split(turnip,"?") | eval radish=mvindex(temp,0) | timechart avg(clock) by radish usenull=true

index=jira sourcetype=access_logs "GET /rest/greenhopper/1.0/xboard/work/allData.json" | rex field=_raw ".*(\d{3}\s\d+)\s(?<clock>\d+)\s" | rex field=_raw ".*allData.json\?rapidViewId=(?<rapidId>\d+)" | search clock > 1000 | eval clock=(clock/1000) | timechart avg(clock) by rapidId usenull=true