topic Re: How to display a chart using an alert query? in Alerting

How to display a chart using an alert query?

lsy9891 — Wed, 30 Sep 2020 01:57:51 GMT

Hi, I'm trying to modify this alert query to display a chart. Currently it displays a table with columns, channel, error type and #Errors. I'm trying to convert this query to become a timechart which counts the number of errors by channel and error type. However I'm getting an error "Error in 'eval' command: The destination key is invalid. " and even if I remove it the timechart cannnot be created? The highlighted parts are the parts I've changed.

earliest=-1d@d latest=@d index=appguids host=netweba* ApplicationID=order20 ApplicationSource=order errorguid Monster.PaymentProcessor.PaymentFailedException | rex field=Message "(?m)^Message:[^:]+:\s(?.*)$" | stats count BY type,ChannelID | lookup local=1 MonsterChannels ChannelId AS ChannelID | eval Channel=if(isnull(Channel) OR match(Channel,"^0$"),"Unknown ChannelID", Channel) . " [ChannelID: " . ChannelID . "]" | stats values(type) AS "Error Type", list(count) AS "#Errors" BY Channel | appendpipe [ stats sum("#Errors") AS "#Errors" BY Channel | eval "Error Type"="Total for Channel" ] | stats values(Channel) AS X, list("Error Type") AS "Error Type", list("#Errors") AS "#Errors" BY Channel | fields - X |

eval=channel_error= Channel.":".Error Type | timechart span=1h count(#Errors) BY channel_error

Re: How to display a chart using an alert query?

gcusello — Fri, 30 Aug 2019 11:00:34 GMT

Hi lsy9891,
at first beware because there an = after the eval in the last row!
In addition I see count(#Errors) , it's better count("#Errors") .
Then there could be a mismatch for the space in fields (Error Type), so it's better to use fields without spaces and eventually rename them at the end of the search.

Bye.
Giuseppe

Re: How to display a chart using an alert query?

Sukisen1981 — Wed, 30 Sep 2020 02:01:26 GMT

eval=channel_error= Channel.":".Error Type | timechart span=1h count(#Errors) BY channel_error
OR
eval channel_error= Channel.":".Error Type | timechart span=1h count(#Errors) BY channel_error
there is an = between eval and channel_error

Re: How to display a chart using an alert query?

lsy9891 — Wed, 04 Sep 2019 04:08:07 GMT

Hi I've corrected the problems but it returns no results are found when I added the timechart command? Basically I need to create a graph from the alert where the x axis is the channel and there are two y axis- one for error type and one for error count?

Re: How to display a chart using an alert query?

lsy9891 — Wed, 04 Sep 2019 05:27:23 GMT

Okay so now my chart shows the total number of errors for each channel ID by adding this line:

chart count(ErrorType) AS TotalError BY Channel

How do I get it to show the total errors for each error type as well?

Re: How to display a chart using an alert query?

gcusello — Wed, 04 Sep 2019 07:03:00 GMT

Hi lsy9891,
let me understand: in this way tou have the count of ErrorTypes for each Channel.
Now you want (in a different panel) the total count of errors for each Error Type, is it correct?
if this is your need you have to create a new search changing the last row.

| stats count AS TotalError BY ErrorType

In this case it's useful to use the Post Process Search, a method to execute a search in a dashboard common to more panels only one time.
In other words (see Splunk Dashboard Examples App at https://splunkbase.splunk.com/app/1603/ ), you have to creare a base search with your search without the last row, and then in each panel call the base search and adding the different last row of each panel.

Bye.
Giuseppe