topic Re: Count the Error, Info and Warnings in Deployment Architecture

Count the Error, Info and Warnings

a508184 — Mon, 24 Dec 2018 13:39:28 GMT

Am very new to splunk, i need a query to get the count and percentage of Error, Info and Warnings in a table.

Error, Info and Warnings filed is already extracted.

Thanks in advance team.

Thanks,
Nithin Setty

Re: Count the Error, Info and Warnings

renjith_nair — Mon, 24 Dec 2018 14:01:24 GMT

@a508184,
Nithin, are these values of a field Status or do you have fields called Error,Info ,etc with count , for e.g.

Error   Warning Info
12      10      15

Would be nice if you could share some sample events (anonymize confidential data)

Re: Count the Error, Info and Warnings

richgalloway — Mon, 24 Dec 2018 14:02:26 GMT

What queries have you tried so far?
Are Error, Info, and Warnings separate fields or possible values of a single field?

Re: Count the Error, Info and Warnings

a508184 — Mon, 24 Dec 2018 15:21:46 GMT

Thanks for your response Renjith.

Same Log is
"12-15 20:22:55,671 ERROR - logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 connect fail XXX:XXX Connection refused (Connection refused)"

"12-15 20:22:55,671 Info- logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 Connected

Currently am using below search.
index = bla source="" Field2= host=* |top 1 Field2 by source, host |rename Field2 as Status, host as HOST

Filed2 is ERROR, INFO or WARN

Output am getting at present is:
source↕ HOST↕ Status↕ count↕ percent↕
app/log.txt ServerName INFO 95 100.000000

Expected Output i need is similar to:
Source↕ HOST↕ Status↕ count↕ percent↕ Status↕ count↕ percent↕ Status↕ count↕ percent↕
app/log.txt ServerName INFO 95 100 Error 0 0 Warn 0 0

Re: Count the Error, Info and Warnings

a508184 — Mon, 24 Dec 2018 15:22:05 GMT

Thanks for your response Rich.

Same Log is
"12-15 20:22:55,671 ERROR - logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 connect fail XXX:XXX Connection refused (Connection refused)"

"12-15 20:22:55,671 Info- logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 Connected

Currently am using below search.
index = bla source="" Field2= host=* |top 1 Field2 by source, host |rename Field2 as Status, host as HOST

Filed2 is ERROR, INFO or WARN

Output am getting at present is:
source↕ HOST↕ Status↕ count↕ percent↕
app/log.txt ServerName INFO 95 100.000000

Expected Output i need is similar to:
Source↕ HOST↕ Status↕ count↕ percent↕ Status↕ count↕ percent↕ Status↕ count↕ percent↕
app/log.txt ServerName INFO 95 100 Error 0 0 Warn 0 0

Re: Count the Error, Info and Warnings

richgalloway — Tue, 29 Sep 2020 22:32:05 GMT

Try this:

index = bla source="" Field2=* host=* | stats count as total, count(eval(Field2="INFO")) as Info, count(eval(Field2="WARN")) as Warn, count(eval(Field2="ERROR")) as Error by source host | eval InfoPct=round(Info*100/total),2), WarnPct=round(Warn*100/total,2), ErrorPct=round(Error*100/total,2) | table source host Field2 Info InfoPct Warn WarnPct Error ErrorPct

Re: Count the Error, Info and Warnings

a508184 — Wed, 26 Dec 2018 11:58:49 GMT

Thanks Rich for your help