topic Re: Create Dashboard and show error code & count in Dashboards & Visualizations

Create Dashboard and show error code & count

rajiv_kumar — Wed, 18 May 2011 18:59:32 GMT

We need to create Dashboard. In dashboard, need to show Error code (001, 002, 003...) in X-axis and count() in Y-axis in 1 hr span.
Please suggest me if any idea.

Re: Create Dashboard and show error code & count

Masa — Mon, 28 Sep 2020 09:34:55 GMT

Do you mean that X is time and Y is count, like a timechart example?

Assuming your event logs are like Splunk inernal web_access.log whih has status code, such as 200, 404 etc. The field name is called "status".

If you want to see the counts of each status code in timechart, and every 10 minutes time span for the past hour, please try the following query as an example.

index=_internal source="web_access.log" | timechart span=1h count by status

Try and show it in Report or Advanced Charting page. If the graph is what you are looking for, please save the search, create a dashboard from "Action" dropdown menue in Search page.

Re: Create Dashboard and show error code & count

rajiv_kumar — Thu, 19 May 2011 18:02:08 GMT

I am looking x-axis should have Error Code(The code generated by my log Ex: Error:00001, Error:00002 etc) and Y- axis should have count(How many error happend during some period of time)

Re: Create Dashboard and show error code & count

Masa — Thu, 19 May 2011 18:16:49 GMT

If you have the field called "Error", and specify the time range at search time;

| stats count by Error

Or,

earliest=-1h@h latest=@h | stats count by Error

Or,

earliest=-1h@h latest=@h | chart count by Error