topic Re: How to separate fields and create a pie chart of status count? in Splunk Search

How to separate fields and create a pie chart of status count?

thaara — Mon, 08 Jun 2020 18:08:50 GMT

Hi Splunkers,

Please guide us on the requirement below:

Input:

server, env, req no, input field,status
host-1,PROD,1666680,mobile1,Deployment_Successful
host-1,PROD,1666680,mobile2,Deployment_failed
host-1,PROD,1666680,mobile3,exception
host-1,PROD,1666001,mobile1,Deployment_Successful
host-1,PROD,1666601,mobile2,Deployment_failed
host-1,PROD,16666801,mobile3,exception

Expected output: Pie chart with status count

My trial:

sourcetype=sourcetype1 source=*.log  
| rex field=_raw "(?\w+\-\d+)\,(?\w+\/\w+)\,(?\d+)\,(?\w+)\,,(?\w+.*)" 
| stats count by Status

The above search is not showing the count if the log has different statuses. Kindly help to guide on this.

Re: How to separate fields and create a pie chart of status count?

richgalloway — Mon, 01 Jun 2020 17:51:04 GMT

Please edit your question to correct the rex command. Also, please share your results and the desired output.

Re: How to separate fields and create a pie chart of status count?

thaara — Mon, 01 Jun 2020 18:02:22 GMT

sourcetype=sourcetype1 source=.log | rex field=_raw "(?\w+-\d+)\,(?\w+\/\w+)\,(?\d+)\,(?\w+)\,(?\w+.)" | stats count by Status

Output am getting as NONE in pie chart view.

please note: If i have only one kind of status example as "deployment_successful" in my log, I can seethe count, but if there are different statuses, I cannot create a pie chart

Re: How to separate fields and create a pie chart of status count?

richgalloway — Mon, 01 Jun 2020 19:48:08 GMT

Your regular expression (rex command) doesn't match the data.

Re: How to separate fields and create a pie chart of status count?

richgalloway — Mon, 01 Jun 2020 19:52:08 GMT

Try this run-anywhere example, which displays a pie chart with 3 segments.

| makeresults | eval _raw="host-1,PROD,1666680,mobile1,Deployment_Successful|
 host-1,PROD,1666680,mobile2,Deployment_failed|
 host-1,PROD,1666680,mobile3,exception|
 host-1,PROD,1666001,mobile1,Deployment_Successful|
 host-1,PROD,1666601,mobile2,Deployment_failed|
 host-1,PROD,16666801,mobile3,exception" | eval _raw=split(_raw, "|") | mvexpand _raw
`comment("All of the above just sets up test data")`
 | rex field=_raw "(\w+\-\d+)\,(\w+)\,(\d+)\,(\w+),(?<Status>\w+.*)"
 | stats count by Status

Re: How to separate fields and create a pie chart of status count?

thaara — Tue, 02 Jun 2020 16:35:14 GMT

@richgalloway
I want to take input data from a log file instead of giving input in my query. Kindly help on that.

Re: How to separate fields and create a pie chart of status count?

richgalloway — Tue, 02 Jun 2020 17:26:41 GMT

Replace everything above the comment with the SPL you use to input data from your log file. For example,

sourcetype=sourcetype1 source=*.log
| rex field=_raw "(\w+\-\d+)\,(\w+)\,(\d+)\,(\w+),(?<Status>\w+.*)"
| stats count by Status