topic Re: Error and Warning Count by Hour or date or timestamp in Splunk Search

Error and Warning Count by Hour or date or timestamp

satyajit2007 — Thu, 12 Nov 2020 07:46:32 GMT

I have my spark logs in Splunk .

I have got 2 Spark streaming jobs running .It will have different logs ( INFO, WARN, ERROR etc) .

I want to create a dashboard for the error Count by hour or any better way ( suggest please)

index=myindex AND (sourcetype=sparkjob1 OR sourcetype=sparkjob2 ) | stats count as total_logs count(eval(level="INFO")) as total_errors</query>

Please also advise if you have any better suggestion with useful dashboard.

Re: Error and Warning Count by Hour or date or timestamp

thambisetty — Thu, 12 Nov 2020 07:59:34 GMT

index=myindex (sourcetype=sparkjob1 OR sourcetype=sparkjob2 ) | timechart count as total_logs count(eval(level="ERROR")) as total_errors span=1h

Re: Error and Warning Count by Hour or date or timestamp

satyajit2007 — Thu, 12 Nov 2020 08:12:08 GMT

thank you a lot .

1) As i have 2 applications Source types, do i need to make separate graphs? Can i do something by which i can identify those error/Info/warn belongs to which Job ?

2) Also If i need to do to add some texts like error, failed, exceptions to the ERROR bucket in the above example?