topic Re: Timechart issue in Splunk Search

Timechart issue

clementros — Wed, 30 Sep 2020 03:09:57 GMT

Hi all,

I have extracted a field (exit_status) in log file. I want to know if a process exit properly.

I have 3 use cases that can be found in log files, exit_status = normaly, exit_status= -1 or exit_status not exist.

I want to have a visualisation wich count the number of exit_status = normaly and the number of file that not exit normaly ( exit_status = -1 + exit_status do not exist)

I don't know how to create a counter of existing value (-1) plus the number of file where exit_status do not exist.

Re: Timechart issue

gcusello — Wed, 30 Sep 2020 03:10:01 GMT

Hi @clementros,
a little question: have you a process_id that permits to correlate begin process with exit_status?
if yes it's easy to build your search, otherwise you have to find a way to count the executed processes.

In the first case you could have something like this:

index=your_index (process_id=* OR exit_status=*)
| stats values(exit_status) AS exit_status BY process_id
| fillnull value="No exit_status" exit_status
| table process_id exit_status

In the second case you can have only a total of the processes without exit_status.

Ciao.
Giuseppe

Re: Timechart issue

clementros — Fri, 29 Nov 2019 09:30:30 GMT

Hi @gcusello

Thank you for your help. The result is good but i do not know how to plot this with a exit_status value count every day

Re: Timechart issue

gcusello — Fri, 29 Nov 2019 09:38:24 GMT

Hi @clementros,
Try something like this:

index=your_index (process_id=* OR exit_status=*)
| stats earliest(_time) AS _time values(exit_status) AS exit_status BY process_id
| fillnull value="No exit_status" exit_status
| timechart span=1d count BY exit_status

Ciao.
Giuseppe

Re: Timechart issue

clementros — Fri, 29 Nov 2019 09:44:21 GMT

It works than you